CVE-2026-66797: 
Apache CloudStack vulnerability analysis and mitigation

CVE-2026-66797 is an improper access control vulnerability in Apache CloudStack's annotation functionality that allows any authenticated user to create unauthorized annotations and disclose existing annotations on entities they do not own. The flaw affects Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It was first published on August 11, 2026, with the Apache security advisory released on August 21, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Apache Advisory).

The root cause is classified as CWE-862 (Missing Authorization) and CWE-284 (Improper Access Control). The addAnnotation and listAnnotation APIs in Apache CloudStack perform an ownership check when an entity's UUID is supplied, but critically fail to enforce the result of that check — meaning the check is executed but its outcome is ignored. This allows any authenticated user (with low privileges) to supply an arbitrary entity UUID via a network-accessible API call to write annotations to or read existing annotations from entities they do not own, with no user interaction required (GitHub Advisory, Apache Advisory).

Successful exploitation allows any authenticated CloudStack user to read annotations/comments attached to cloud infrastructure entities (e.g., VMs, networks, accounts) owned by other tenants, potentially exposing sensitive operational notes or configuration details (confidentiality impact). Attackers can also write arbitrary annotations to entities they do not own, which could be used to inject misleading information or disrupt operational workflows (integrity impact). Availability is not directly impacted, but in multi-tenant cloud environments, cross-tenant annotation disclosure poses a meaningful data exposure risk (GitHub Advisory, Apache Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.18–0.26%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only valid user credentials and network access to the CloudStack API, making it low-complexity but limited in scope to authenticated users.

1. Reconnaissance: Identify a target Apache CloudStack deployment running a vulnerable version (4.15.0.0–4.20.3.0 or 4.21.0.0–4.22.1.0) and obtain valid user credentials for any account on the platform.
2. Enumerate entity UUIDs: Use legitimate CloudStack API calls (e.g., listVirtualMachines, listNetworks) to discover UUIDs of entities owned by other users or accounts within the environment.
3. Exploit addAnnotation API: Send an authenticated API request to the addAnnotation endpoint, supplying the UUID of an entity owned by another user. Despite the ownership check being performed, its result is not enforced, so the annotation is written successfully.
4. Exploit listAnnotation API: Send an authenticated API request to the listAnnotation endpoint with the target entity's UUID to retrieve existing annotations/comments, potentially exposing sensitive operational information left by administrators or other tenants.
5. Leverage disclosed information: Use any sensitive data found in annotations (e.g., credentials, configuration notes, internal IP addresses) for further lateral movement or privilege escalation within the cloud environment (GitHub Advisory, Apache Advisory).

• Network: Unusual API calls to addAnnotation or listAnnotation endpoints originating from user accounts that do not own the referenced entity UUIDs; high volume of annotation API requests from a single low-privilege account.
• Logs: CloudStack API audit logs showing addAnnotation or listAnnotation requests where the requesting account's domain/tenant does not match the entity owner; repeated cross-tenant UUID references in API logs.
• Application: Unexpected annotations appearing on VMs, networks, or other resources owned by accounts that did not create them; annotation content inconsistent with the owning account's activity.

Apache has released patched versions 4.20.3.1 and 4.22.1.1 that correctly enforce the ownership check result in the annotation APIs. Users should upgrade to version 4.20.3.1 (for the 4.20.x LTS branch) or 4.22.1.1 (for the 4.22.x branch) or later as the primary remediation. As a temporary workaround pending upgrade, administrators should monitor and audit annotation API activity for cross-tenant access patterns and consider restricting API access to trusted networks (Apache Advisory, GitHub Advisory).

ShapeBlue, a major Apache CloudStack contributor and managed service provider, published a security advisory covering the fixes included in Apache CloudStack 4.20.3.1 and 4.22.1.1 (ShapeBlue Advisory). The Apache Software Foundation announced the security releases via the official announce mailing list. No significant broader media coverage or notable researcher commentary beyond vendor channels has been observed for this moderate-severity issue.