CVE-2026-66721: Apache CloudStack: Authorization issue with listHostTags for domain admins
Missing authorization issue for domain admins in CloudStack's host tags listing functionality.
Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.
This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.20.3.1 - Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Who can access information outside their intended scope?
Domain Admins can retrieve host tags for every host in the CloudStack environment, rather than only hosts dedicated to their own domain.
Is the default configuration affected?
Yes. Domain Admins have permission to call the listHostTags API by default, and the affected API does not apply domain scoping to the returned host tags.
Which versions need remediation?
Affected releases are 4.12.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrade to 4.20.3.1, 4.22.1.1, or a later version.