CVE-2026-50112: Apache CloudStack Flaw Allows Cross-Tenant Remote Code Execution on KVM Hosts

TL;DR

Apache CloudStack shipped releases 4.20.3.1 and 4.22.1.1. They fix 20 CVEs across the platform. The most serious, CVE-2026-50112, allows cross-tenant remote code execution as root on KVM hypervisor hosts. No exploitation in the wild or public proof-of-concept has been confirmed.

Notable CVEs

Why This CloudStack Flaw Matters

CloudStack runs large private and public clouds. Many hosts share the same physical infrastructure. Therefore a cross-tenant escape is a worst-case event. CVE-2026-50112 delivers exactly that. An ordinary tenant can reach root on the KVM host that runs other tenants’ VMs. The official CloudStack advisory lists all fixed issues.

How the Remote Code Execution Works

The flaw sits in template handling. A tenant with the default User role can register a VM template. That template can use directDownload and point to a .metalink file. The management server fetches the metalink XML. It then dispatches the download to the KVM agent.

However, inner URLs inside the metalink are never re-checked against the scheme allowlist. As a result, an attacker can steer the process toward command execution. The outcome is arbitrary shell commands running as root. This is cross-tenant root on shared compute, reachable through the public API. The same advisory also flags a related SSRF via metalink mirror resolution.

Other Command Execution Risks

Two more flaws allow command execution for privileged roles. CVE-2026-47359 injects commands through an unsanitized mount option in the NAS backup plugin. CVE-2026-61400 abuses the diagnostics APIs to run commands as root on system VMs and virtual routers. Both need specific roles, yet both can mean full instance compromise.

The Wider Batch

The remaining CVEs cover a broad range. They include OAuth token and secret leaks, SAML signature bypass, and several cross-tenant access control gaps. Others cover stored XSS, an LDAP config disclosure, and a management-server denial of service. Severity ranges from Low to Critical.

Affected Versions

The flaws affect many releases from the 4.x line up to 4.20.3.0 and 4.22.1.0. Exact ranges vary by CVE. Some reach back several years, while a few affect only recent 4.21 and 4.22 builds.

Patch and Mitigation Steps

Upgrade to CloudStack 4.20.3.1 or 4.22.1.1 as soon as possible. The project provides no standalone patch for these issues. After upgrading, review operator and tenant roles. Limit who can register templates, run diagnostics, and manage backups. Restricting these high-risk APIs reduces exposure during any future flaw.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.