Apache CloudStack up to 4.20.3.0/4.22.1.0 Userdata Reference APIs missing authentication

Summaryinfo

A vulnerability classified as very critical has been found in Apache CloudStack up to 4.20.3.0/4.22.1.0. This issue affects the function deleteUserData/linkUserDataToTemplate/resetUserDataForVirtualMachine/deployVirtualMachine/updateVirtualMachine/deleteCniConfiguration of the component Userdata Reference APIs. This manipulation causes missing authentication. This vulnerability is tracked as CVE-2026-50222. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as very critical was found in Apache CloudStack up to 4.20.3.0/4.22.1.0. Affected by this vulnerability is the function deleteUserData/linkUserDataToTemplate/resetUserDataForVirtualMachine/deployVirtualMachine/updateVirtualMachine/deleteCniConfiguration of the component Userdata Reference APIs. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

The advisory is shared at lists.apache.org. This vulnerability is known as CVE-2026-50222 since 06/04/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/21/2026).

Upgrading to version 4.20.3.1 or 4.22.1.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Apache

Name

• CloudStack

Version

• 4.20.0
• 4.20.1
• 4.20.2
• 4.20.3.0
• 4.22.0
• 4.22.1.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion