Apache CloudStack up to 4.20.3.0/4.22.1.0 Diagnostics getDiagnosticsData/runDiagnostics command injection

Summaryinfo

A vulnerability classified as very critical was found in Apache CloudStack up to 4.20.3.0/4.22.1.0. Impacted is the function getDiagnosticsData/runDiagnostics of the component Diagnostics. Such manipulation leads to command injection. This vulnerability is listed as CVE-2026-61400. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Apache CloudStack up to 4.20.3.0/4.22.1.0. Affected by this issue is the function getDiagnosticsData/runDiagnostics of the component Diagnostics. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router. The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

The advisory is available at lists.apache.org. This vulnerability is handled as CVE-2026-61400 since 07/09/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/21/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Upgrading to version 4.20.3.1 or 4.22.1.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Cloud Software

Vendor

• Apache

Name

• CloudStack

Version

• 4.20.0
• 4.20.1
• 4.20.2
• 4.20.3.0
• 4.22.0
• 4.22.1.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion