CVE-2026-62440: Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Q: Which deployments are affected?

Deployments using the Apache CloudStack Kubernetes Service (CKS) plugin in versions 4.21.0.0 through 4.22.1.0 are affected.

Q: What access does an attacker need?

The issue enables cross-tenant manipulation of Kubernetes clusters during node-addition and node-removal operations. The provided information does not further specify the attacker’s required authentication level or permissions.

Q: What is the recommended remediation?

Upgrade Apache CloudStack to version 4.22.1.1 or later, which fixes the access-control issue.

Published Aug 21, 2026

Updated

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.

This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.

Affected Software

1 affected component

Apache CloudStack Kubernetes Service (CKS) plugin>=4.21.0.0<=4.22.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CloudStack (Kubernetes Service / CKS plugin) to a version that resolves this vulnerability.
Fixed in 4.22.1.1

Event History

Aug 21, 2026

CVE Published

via MITRE·08:23 AM

Data Sourced

via MITRE·08:23 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using the Apache CloudStack Kubernetes Service (CKS) plugin in versions 4.21.0.0 through 4.22.1.0 are affected.

What access does an attacker need?

The issue enables cross-tenant manipulation of Kubernetes clusters during node-addition and node-removal operations. The provided information does not further specify the attacker’s required authentication level or permissions.

What is the recommended remediation?