CVE-2026-66722 Apache Software Foundation CVE debrief

Who should care

Domain admins and users of Apache CloudStack, particularly those with version 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0, should review project role permissions and perform inventory checks to identify potential exposure. Security teams and vulnerability management teams should also review the issue and plan for mitigations if necessary. Operators and platform administrators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Technical summary

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack allows a malicious Domain Admin to tamper with project roles and permissions across unrelated domains. This issue affects Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Domain admins should verify project role configurations, perform inventory checks to identify potential exposure, and review compensating controls for exposed systems.

Defensive priority

Domain admins should verify project role permissions and perform inventory checks to identify potential exposure.

Recommended defensive actions

• Upgrade to version 4.20.3.1 or 4.22.1.1 or later
• Verify project role permissions
• Perform inventory checks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

Evidence is limited; primary official records indicate improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. Defenders should verify project role configurations, perform inventory checks, and review compensating controls. Limited evidence suggests potential exposure across domains; further review is necessary. Security teams should track exceptions, retest remediated assets, and confirm whether affected product deployments exist in managed environments.

Official resources