CVE-2026-66797 Apache Software Foundation CVE debrief

Who should care

Users of Apache CloudStack from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0 should be aware of the improper access control in CloudStack's annotation functionality, which allows unauthorized comment creation and disclosure. This affects operators, platforms, vulnerability-management teams, and security teams responsible for ensuring the security and integrity of their CloudStack deployments. They should review the official advisory and plan for an upgrade to version 4.20.3.1 or 4.22.1.1 or later. Compensating controls and monitoring should be considered for exposed systems while remediation is scheduled and verified. Asset inventory and change management processes should also be reviewed to ensure affected deployments are identified and remediated promptly. Additionally, tracking exceptions and retesting remediated assets are crucial steps in verifying the effectiveness of the remediation efforts. Source tracking and exposure reviews are also recommended to understand the potential impact and to implement necessary mitigations effectively. Defensive priorities should be set based on the potential operational impact of the vulnerability, focusing on authentication and authorization mechanisms within CloudStack deployments. Monitoring for unauthorized comment creation and disclosure is essential to detect potential exploitation attempts. Overall, a comprehensive approach involving vendor patch guidance, exposure review, compensating controls, monitoring, asset inventory management, and source tracking is necessary to address this vulnerability effectively. Rollback/change windows should be planned to minimize disruptions during remediation. By taking these steps, organizations can enhance their security posture and reduce the risk associated with this vulnerability in CloudStack deployments. Security teams should lead the effort to implement these recommendations and ensure that all necessary actions are taken to protect against potential exploitation. This includes verifying that affected deployments exist, assigning owners for follow-up, and documenting evidence of remediation efforts. In summary, a multi-faceted approach involving technical,

Technical summary

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This issue lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. Affected versions include Apache CloudStack from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Defensive priority

Authenticated users may be able to create unauthorized comments and disclose existing annotations on entities they do not own. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later.

Recommended defensive actions

• Upgrade to version 4.20.3.1 or 4.22.1.1 or later
• Restrict access to annotation functionality
• Monitor for unauthorized comment creation and disclosure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. The issue affects Apache CloudStack from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later. Evidence limits suggest verifying affected deployments, reviewing official advisories, and tracking exceptions.

Official resources