Apache CloudStack LTS Security Bulletin: Multiple Vulnerabilities Fixed (CVE-2025-66170, CVE-2025-66467, CVE-2026-25077)

Apache CloudStack LTS Security Vulnerability Summary Vulnerability Overview Apache CloudStack has released LTS versions 4.20.3.0 and 4.22.0.1, addressing multiple security vulnerabilities. Key vulnerabilities include: 1. CVE-2025-66170: Incorrect authorization logic in the CloudStack Backup plugin allows users to list backups they should not have access to. 2. CVE-2025-66171: Incorrect authorization logic in the CloudStack Backup plugin allows users to create new virtual machines from backups they should not have access to. 3. CVE-2025-66172: Incorrect access control logic in the CloudStack Backup plugin allows users to restore volumes from other users' backups and attach them to their own virtual machines. 4. CVE-2025-66467: Missing MinIO policy cleanup during bucket deletion via Apache CloudStack allows users to retain access to buckets they previously owned. 5. CVE-2025-69233: Domain/account resource limits are not enforced due to race conditions in resource count checks and incrementing logic, allowing users to exceed their allocated resource limits. 6. CVE-2026-25077: Lack of filename sanitization allows attackers to register malicious templates and execute arbitrary code on KVM hosts. 7. CVE-2026-25199: The Proxmox extension incorrectly uses user-editable instance settings, allowing non-privileged attackers to modify settings to reference virtual machines belonging to another account. Affected Versions CVE-2025-66170, CVE-2025-66171, CVE-2025-66172: Affects Apache CloudStack 4.21.0.0 to 4.22.0.0. CVE-2025-66467: Affects Apache CloudStack 4.19.0.0 to 4.20.2.0 and 4.21.0.0 to 4.22.0.0. CVE-2025-69233: Affects Apache CloudStack 4.0.0 to 4.20.2.0 and 4.21.0.0 to 4.22.0.0. CVE-2026-25077: Affects Apache CloudStack 4.11.0 to 4.20.2.0 and 4.21.0.0 to 4.22.0.0. CVE-2026-25199: Affects Apache CloudStack 4.21.0.0 to 4.22.0.0. Remediation CVE-2025-66170, CVE-2025-66171, CVE-2025-66172, CVE-2026-25199: Upgrade to version 4.22.0.1 or later is recommended. CVE-2025-66467, CVE-2025-69233, CVE-2026-25077: Upgrade to version 4.20.3.0 or 4.22.0.1 or later is recommended. Workaround For existing installations, Proxmox instance details can be protected from editing by adding to the global configuration parameters. Downloads and Documentation Official source code is available on the Apache CloudStack downloads page. Release notes for version 4.22.0.1 can be found here. Individual release packages are available on the Apache CloudStack download page.

Goal Reached Thanks to every supporter — we hit 100%!

Apache CloudStack LTS Security Bulletin: Multiple Vulnerabilities Fixed (CVE-2025-66170, CVE-2025-66467, CVE-2026-25077)