CVE-2025-66467: 
Apache CloudStack vulnerability analysis and mitigation

CVE-2025-66467 is an incomplete cleanup vulnerability in Apache CloudStack where MinIO policies are not removed upon bucket deletion, allowing previous bucket owners to retain unauthorized access. If a new user creates a bucket with the same name as a previously deleted one, the former owner can gain unauthorized read and write access using their previously generated access and secret keys. The vulnerability affects Apache CloudStack versions 4.19.0.0 through 4.20.2.0 and 4.21.0.0 through 4.22.0.0. It was disclosed on May 8, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Apache Advisory, OSS-Sec).

The root cause is classified as CWE-459 (Incomplete Cleanup): when a user deletes an object storage bucket via Apache CloudStack, the associated MinIO access policy is not purged from the MinIO backend. This means the former bucket owner's access and secret keys remain authorized in MinIO's policy store. If another user subsequently creates a new bucket with the identical name, the stale policy grants the previous owner full read and write access to the new bucket's contents without any additional authentication steps. The attack vector is network-based, requires low privileges (an authenticated CloudStack account), and no user interaction (OSS-Sec, Apache Advisory).

Successful exploitation allows an authenticated CloudStack user to gain unauthorized read and write access to object storage buckets owned by other users, resulting in high confidentiality and integrity impact. An attacker could exfiltrate sensitive data stored in the victim's bucket or overwrite/corrupt its contents. Availability is not directly impacted, but data integrity and cross-tenant data isolation are severely compromised in multi-user CloudStack environments leveraging MinIO object storage (Apache Advisory, OSS-Sec).

1. Obtain authenticated access: Acquire a valid CloudStack user account in a multi-tenant environment that uses MinIO as the object storage backend.
2. Create and then delete a bucket: Using the CloudStack interface or API, create an object storage bucket and generate access/secret key credentials for it, then delete the bucket.
3. Retain old credentials: Save the previously generated MinIO access key and secret key — these remain valid in MinIO's policy store even after bucket deletion.
4. Wait for bucket name reuse: Monitor or wait until another user creates a new bucket with the same name as the previously deleted bucket (this may be predictable in environments with naming conventions).
5. Access the new bucket: Use the retained access and secret keys directly against the MinIO API or S3-compatible client to read from or write to the new bucket, bypassing the new owner's access controls (OSS-Sec, Apache Advisory).

• Logs: CloudStack or MinIO access logs showing S3 API requests (GET, PUT, LIST) to a bucket using credentials belonging to a user who no longer owns that bucket; authentication events in MinIO logs where the access key does not match the current bucket owner's account.
• Network: S3-compatible API calls (port 443 or 9000) to the MinIO endpoint using access keys associated with deleted or former bucket owners.
• Application: Discrepancies between CloudStack's bucket ownership records and MinIO policy assignments — specifically, MinIO policies referencing users/keys for buckets they no longer own in CloudStack's database.

Apache CloudStack has released patched versions that properly clean up MinIO policies upon bucket deletion. Users should upgrade to Apache CloudStack 4.20.3.0 (for the 4.19.x/4.20.x branch) or 4.22.0.1 (for the 4.21.x/4.22.x branch) or later. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. As an interim measure, administrators can manually audit and remove stale MinIO policies for deleted buckets (Apache Advisory, OSS-Sec).

ShapeBlue, a major CloudStack contributor, published a security advisory covering the 4.20.3.0 and 4.22.0.1 releases that address this and related vulnerabilities (ShapeBlue). The vulnerability was also noted in a Reddit CVE Watch thread listing it among top trending CVEs for the week of May 11, 2026. Community coverage has been moderate, with aggregators and security news outlets picking up the advisory shortly after disclosure.