CVE-2026-66722: 
Apache CloudStack vulnerability analysis and mitigation

CVE-2026-66722 is an improper authorization vulnerability affecting Apache CloudStack that allows a Domain Admin to perform CRUD operations on Project Roles and Project Role permissions across unrelated domains. The authorization check only confirms the caller holds a Domain Admin role without verifying whether the target project belongs to their domain or subdomain, enabling cross-domain privilege abuse. Affected versions include Apache CloudStack 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It was disclosed on August 21, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-285 (Improper Authorization): the CloudStack authorization logic for project role and permission management verifies only that the API caller is a Domain Admin, but fails to validate whether the target project resides within the caller's domain or any of its subdomains. This flaw allows a malicious Domain Admin to invoke create, update, delete, and list operations on project roles and permissions for projects in entirely unrelated domains via the network API. Exploitation requires an authenticated Domain Admin account (high privilege), but no user interaction or special configuration is needed beyond that (Apache Advisory, GitHub Advisory).

A malicious Domain Admin can create unauthorized project roles, modify existing role permissions, or delete roles for projects in any domain within the CloudStack deployment, not just their own. This can lead to privilege escalation within targeted projects, disruption of access controls, unauthorized data access, and potential denial of service for project operations across organizational boundaries. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, reflecting the broad control an attacker gains over cross-domain project governance (GitHub Advisory, Apache Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.13–0.33%, indicating a low near-term exploitation probability. Exploitation requires an authenticated Domain Admin account, which limits the attack surface to insider threats or compromised privileged accounts (GitHub Advisory, Apache Advisory).

1. Obtain Domain Admin credentials: The attacker must already possess or compromise a Domain Admin account in any domain within the Apache CloudStack deployment.
2. Identify target projects in other domains: Use the CloudStack API (e.g., listProjects with appropriate parameters) to enumerate projects across domains, leveraging the insufficient domain boundary check.
3. Perform unauthorized CRUD operations: Issue API calls such as createProjectRole, updateProjectRole, deleteProjectRole, listProjectRoles, createProjectRolePermission, updateProjectRolePermission, or deleteProjectRolePermission, specifying the ID of a project in an unrelated domain as the target.
4. Escalate privileges or disrupt access: By creating or modifying project roles and permissions in the target domain, the attacker can grant themselves or others elevated access to resources in that project, remove legitimate user permissions, or delete critical roles to disrupt operations (Apache Advisory, GitHub Advisory).

• Logs: CloudStack API audit logs showing createProjectRole, updateProjectRole, deleteProjectRole, createProjectRolePermission, updateProjectRolePermission, or deleteProjectRolePermission API calls from a Domain Admin account targeting projects outside their own domain or subdomain.
• Logs: Unusual frequency or pattern of project role/permission modification events originating from a single Domain Admin account across multiple unrelated domains.
• Application Behavior: Unexpected changes to project roles or permissions in domains not managed by the acting Domain Admin, particularly new roles with elevated permissions or deletion of existing roles.
• Network: API requests to CloudStack management server endpoints for project role management from unexpected source IPs associated with a Domain Admin account.

Apache has released patched versions 4.20.3.1 and 4.22.1.1, which fix the improper domain boundary check in project role authorization. Users should upgrade to one of these versions or later as the primary remediation. As an interim workaround, restrict Domain Admin privileges to only trusted personnel and monitor CloudStack API audit logs for cross-domain project role and permission modifications. ShapeBlue has also published a security advisory covering these fixes (Apache Advisory, ShapeBlue Advisory).

ShapeBlue, a major Apache CloudStack contributor and managed service provider, published a corresponding security advisory covering the fixes in versions 4.20.3.1 and 4.22.1.1 (ShapeBlue Advisory). The Apache Software Foundation announced the vulnerability and patches via the Apache announcement mailing list. No significant broader media coverage or notable researcher commentary beyond vendor channels has been observed for this vulnerability.