CVE-2026-66797 in CloudStack
Summary
by MITRE • 08/21/2026
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.
The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.
This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Apache CloudStack represents a critical failure in access control mechanisms within its annotation subsystem, specifically affecting versions ranging from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. This flaw stems from an improper implementation of ownership verification logic in the addAnnotation and listAnnotation application programming interfaces. While these APIs are designed to perform a check ensuring that only the owner or authorized users can interact with specific entities, the system fails to correctly honor the result of this check when a target entity's universally unique identifier is supplied by the client. Consequently, any authenticated user who possesses knowledge of an entity UUID can bypass intended restrictions and write annotations to resources they do not own, as well as disclose existing comments associated with those unauthorized targets.
From a technical perspective, this issue classifies under CWE-284 Improper Access Control, where the software does not properly restrict access to a resource for unintended actors. The root cause lies in the logic flow of the API handlers which likely check permissions but proceed with execution regardless of the outcome or fail to validate the ownership status against the authenticated user's identity before processing the request. This allows an attacker who has valid credentials within the CloudStack environment to manipulate metadata associated with virtual machines, networks, or other managed resources without authorization. The ability to write annotations enables potential information leakage regarding infrastructure configurations if attackers embed sensitive details in comments, while the disclosure capability exposes internal operational data that should remain private to resource owners and administrators.
The operational impact of this vulnerability is significant for organizations relying on Apache CloudStack for cloud management. Unauthorized access to annotation data can lead to confidentiality breaches as internal notes, troubleshooting logs, or configuration hints stored by system administrators become visible to other users within the same tenant account. Furthermore, the ability to inject arbitrary annotations could be leveraged in social engineering attacks if these comments are displayed in user interfaces used by operations teams, potentially misleading them about the state of infrastructure components. In a multi-tenant environment where strict isolation between customers is paramount, this flaw undermines trust and compliance with data segregation requirements mandated by various regulatory frameworks.
This vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires valid authentication credentials to interact with the API endpoints. It also reflects aspects of T1530 Data from Cloud Storage Object if annotations are considered part of the object metadata that is being exfiltrated or modified without permission. The lack of proper authorization checks allows an attacker to pivot through the management plane by manipulating resource-associated data, which could facilitate further reconnaissance or lateral movement within the cloud environment depending on how downstream systems consume these annotation fields.
To mitigate this risk, users are strongly advised to upgrade Apache CloudStack immediately to version 4.20.3.1 or 4.22.1.1 and later releases where the ownership check logic has been corrected to properly enforce access restrictions based on user identity rather than just UUID presence. Until an upgrade is performed, administrators should implement strict network-level controls such as firewall rules that restrict API endpoint access to only trusted management subnets and IP addresses. Additionally, enabling comprehensive audit logging for all annotation-related API calls can help detect unauthorized attempts in real-time, allowing security teams to respond promptly to potential exploitation activities while planning the necessary patching window.