PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-66171 Lists CVE debrief

CVE-2025-66171 is an access-control issue in the Apache CloudStack Backup plugin affecting versions 4.21.0.0 and 4.22.0.0. According to the supplied advisory text, an authenticated user with access to specific APIs in an environment where the plugin is enabled can create new VMs from backups belonging to other users. Apache recommends upgrading to CloudStack 4.22.0.1 to resolve the issue.

Vendor
Lists
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-09
Advisory published
2026-05-08
Advisory updated
2026-05-09

Who should care

CloudStack administrators, platform owners, and security teams running Apache CloudStack 4.21.0.0 or 4.22.0.0 with the Backup plugin enabled, especially in multi-tenant environments or deployments where authenticated users can reach the affected APIs.

Technical summary

The issue is an improper access logic problem in the Backup plugin. The supplied source describes a scenario where an authenticated user-account holder can use specific API access to create a VM from backups that belong to another user, creating an unauthorized cross-user data and workload access path. The source corpus also lists CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N and CWE-359.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade Apache CloudStack to 4.22.0.1 as recommended by the advisory.
  • Confirm whether the Backup plugin is enabled in any CloudStack 4.21.0.0 or 4.22.0.0 environment.
  • Review which authenticated users can reach the Backup-related APIs and tighten access to the minimum required set.
  • Check logs for unexpected VM creation activity involving backups owned by other accounts.
  • If immediate upgrade is not possible, reduce exposure by limiting access to the affected APIs and monitoring tenant-bound backup operations closely.

Evidence notes

Source corpus states the vulnerability was published on 2026-05-08 and modified on 2026-05-09. The advisory text says the Backup plugin in CloudStack 4.21.0.0 and 4.22.0.0 has improper access logic, and that upgrading to 4.22.0.1 fixes the issue. NVD metadata in the corpus shows vulnStatus 'Undergoing Analysis' and references an Apache security mailing list thread and an oss-security mirror.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-66171 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-66171

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-66171 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-66171

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.