CVE-2026-66721— Apache CloudStack: Authorization issue with listHostTags for domain admins
Quick assessment
Affected
Apache Software Foundation Apache CloudStack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CloudStack 主机标签列表功能中存在针对域管理员的权限缺失问题。 默认情况下，域管理员拥有调用 API 的权限，但该 API 返回的是环境中所有主机所属的标签，而未按域进行范围限制。正确的行为应是仅返回归属于该管理员所在域的专用主机标签。 受影响版本为 Apache CloudStack 4.12.0.0 至 4.20.3.0，以及 4.21.0.0 至 4.22.1.0。 建议用户升级至 4.20.3.1、4.22.1.1 或更高版本，以修复此漏洞。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.12.0.0≤ 4.20.3.0 |
affected |
4.21.0.0≤ 4.22.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66721
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CloudStack: Authorization issue with listHostTags for domain admins
Source: CVE Program / CVE List V5
Vulnerability Description
Missing authorization issue for domain admins in CloudStack's host tags listing functionality.
Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.
This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.12.0.0 ~ 4.20.3.0 | - |
|
II. Public POCs for CVE-2026-66721
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66721
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-66721 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-21 · 21 CVEs total
| CVE-2026-59654 | 6.8 MEDIUM | Apache CloudStack: DoS caused by database connections leak |
| CVE-2026-61397 | Apache CloudStack: OAuth2 Token Cross-Request Leak | |
| CVE-2026-68745 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP | |
| CVE-2026-66797 | Apache CloudStack: Unauthorised comment creation and disclosure | |
| CVE-2026-66722 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue | |
| CVE-2026-65613 | Apache CloudStack: Webhook Deliveries Incorrect Access | |
| CVE-2026-62440 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulatio | |
| CVE-2026-61422 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate | |
| CVE-2026-61400 | Apache CloudStack: Get and Run Diagnostics Command Injection | |
| CVE-2026-61399 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | |
| CVE-2026-61398 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Fun | |
| CVE-2026-59799 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | |
| CVE-2026-59780 | Apache CloudStack: LDAP provider configuration disclosure | |
| CVE-2026-59657 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob | |
| CVE-2026-59655 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | |
| CVE-2026-59085 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs | |
| CVE-2026-50112 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | |
| CVE-2026-47359 | Apache CloudStack: OS Command Injection due to unsanitized mount command | |
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials |
IV. Related Vulnerabilities
Same product: Apache CloudStack
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer -
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulner
Same vendor: Apache Software Foundation
-
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure -
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the und -
CVE-2026-71300
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch -
CVE-2026-63621
Apache Camel: Camel-Knative: CloudEvent extension fields rec -
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authenticat
Same weakness: CWE-862
-
CVE-2026-78266
WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Contro -
CVE-2026-27364
WordPress Style Kits plugin <= 2.6.5 - Broken Access Control -
CVE-2026-71509
Dolibarr < 24.0.0 Expense Report REST API Improper Authoriza -
CVE-2026-71508
Dolibarr < 24.0.0 REST API Improper Authorization via User U -
CVE-2026-71504
Dolibarr < 24.0.0 Members REST API Improper Authorization vi
V. Comments for CVE-2026-66721
No comments yet