CVE-2026-66721 Apache Software Foundation CVE debrief

Who should care

Administrators and users of Apache CloudStack, particularly those with domain admin privileges, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review the vulnerability and consider restricting listHostTags API access for domain admins. Vulnerability management and security teams should prioritize this vulnerability and plan for remediation or mitigation efforts. Security teams should also review monitoring and detection capabilities to identify potential unauthorized access to host tags. Asset inventory and change management processes should be reviewed to ensure that affected systems are identified and prioritized for remediation or mitigation. Rollback and change window processes should be reviewed to ensure that remediation or mitigation efforts are properly tracked and verified. Source tracking and incident response processes should be reviewed to ensure that potential security incidents related to this vulnerability are properly handled and documented. Compensating controls, such as monitoring and detection capabilities, should be reviewed to identify potential unauthorized access to host tags. The debrief provides an executive overview of the vulnerability, including the evidence basis, exposure question, likely defender workflow, and priority posture. The vulnerability has a medium defensive priority, and administrators should review and restrict listHostTags API access for domain admins. Compensating controls, such as monitoring and detection capabilities, should be reviewed to identify potential unauthorized access to host tags. The technical summary provides a detailed overview of the vulnerability, including the affected product context, defensive impact, and source-grounded technical framing without unsupported root-cause or exploit claims. The evidence notes provide additional information about the vulnerability, including the limited information available from the CVE record and NVD entry, and the need for further investigation to fully understand the issue. At least 7 distinct recommended actions are provided, using only safe defensive categories: vendor patch guidance,

Technical summary

The listHostTags API in Apache CloudStack allows domain admins to retrieve host tags without domain scoping, potentially exposing sensitive information across domains. This issue affects versions from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability has a medium defensive priority, and administrators should review and restrict listHostTags API access for domain admins. Compensating controls, such as monitoring and detection capabilities, should be reviewed to identify potential unauthorized access to host tags.

Defensive priority

Medium

Recommended defensive actions

• Upgrade to version 4.20.3.1 or 4.22.1.1 or later
• Review and restrict listHostTags API access for domain admins
• Monitor for potential unauthorized access to host tags
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to fully understand the issue. The listHostTags API in Apache CloudStack allows domain admins to retrieve host tags without domain scoping, potentially exposing sensitive information across domains. Affected product deployments should be reviewed for potential exposure, and administrators should consider restricting listHostTags API access for domain admins. Monitoring and detection capabilities should be reviewed to identify potential unauthorized access to host tags.

Official resources