CVE-2026-66721: 
Apache CloudStack vulnerability analysis and mitigation

CVE-2026-66721 is a missing authorization vulnerability in Apache CloudStack's listHostTags API that allows Domain Admins to retrieve host tags for all hosts across the entire environment, bypassing domain-scoping restrictions. It affects Apache CloudStack versions 4.12.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vulnerability was disclosed on August 21, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 2.7 (Low) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the listHostTags API endpoint performs no domain-scoping check when returning results to Domain Admin callers. By design, Domain Admins are permitted to invoke this API, but the implementation returns host tags for every host in the CloudStack environment rather than restricting results to hosts dedicated to the calling admin's domain. Exploitation requires only valid Domain Admin credentials and a standard network-accessible API call — no special tooling or elevated privileges beyond the Domain Admin role are needed (Apache Advisory, GitHub Advisory).

A Domain Admin can exploit this vulnerability to enumerate host tags for all physical or virtual hosts across every domain in the CloudStack environment, including hosts outside their administrative scope. This exposes infrastructure configuration details — such as host groupings, resource allocation tags, and topology information — that could aid in reconnaissance for further attacks or privilege escalation within the cloud environment. There is no integrity or availability impact; the vulnerability is limited to unauthorized read access to host configuration metadata (GitHub Advisory, Apache Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.13% (0.00132), indicating a low probability of exploitation in the near term. Exploitation requires authenticated Domain Admin access, which significantly limits the attack surface (GitHub Advisory, Apache Advisory).

1. Obtain Domain Admin credentials: Acquire valid Domain Admin account credentials for the target Apache CloudStack environment through phishing, credential reuse, or other means.
2. Authenticate to the CloudStack API: Use the CloudStack API or management console to authenticate as a Domain Admin and obtain a valid API key and secret key pair.
3. Call the listHostTags API: Issue an authenticated API request to the listHostTags endpoint (e.g., GET /client/api?command=listHostTags&apiKey=<key>&signature=<sig>) without any domain-scoping parameters.
4. Collect unrestricted host tag data: Parse the API response, which returns host tags for all hosts across the entire CloudStack environment — not just those in the admin's own domain — revealing infrastructure topology and configuration details (Apache Advisory, GitHub Advisory).

• Logs: CloudStack API access logs showing listHostTags API calls from Domain Admin accounts, particularly at unusual times or with high frequency; cross-domain API calls where the requesting admin's domain does not match the host domains returned.
• Network: API requests to the CloudStack management server's API endpoint (/client/api?command=listHostTags) originating from unexpected IP addresses or outside normal administrative hours.
• Behavioral: A Domain Admin account repeatedly querying listHostTags without corresponding administrative activity (e.g., no host provisioning or management operations) may indicate reconnaissance activity.

Apache has released patched versions 4.20.3.1 and 4.22.1.1 that enforce domain-scoping on the listHostTags API response. Users should upgrade to version 4.20.3.1 (for the 4.20.x branch) or 4.22.1.1 (for the 4.22.x branch) or later as the primary remediation. If immediate patching is not feasible, administrators should review and restrict Domain Admin API permissions and monitor listHostTags API usage for anomalous cross-domain access patterns (Apache Advisory, GitHub Advisory).

ShapeBlue, a major Apache CloudStack contributor and managed service provider, published a security advisory covering the fixes included in Apache CloudStack 4.20.3.1 and 4.22.1.1 (ShapeBlue Advisory). The vulnerability was also picked up by Qualys in their August 2026 application security detections publication. Community reaction has been muted given the low CVSS score and the requirement for existing Domain Admin privileges to exploit.