CVE-2025-26521
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-07-01
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | cloudstack | From 4.17.0.0 (inc) to 4.19.3.0 (exc) |
| apache | cloudstack | From 4.20.0.0 (inc) to 4.20.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when an Apache CloudStack user creates a CKS-based Kubernetes cluster in a project. The API key and secret key of the 'kubeadmin' user from the creator's account are embedded in the cluster's secret configuration. Any project member who can access the Kubernetes cluster can also access these keys, allowing them to impersonate the 'kubeadmin' user and perform privileged actions. This can lead to a complete compromise of the confidentiality, integrity, and availability of the creator's account resources.
How can this vulnerability impact me? :
If you are a member of a project with a CKS-based Kubernetes cluster created by another user, you could gain unauthorized access to the API and secret keys of the cluster creator's 'kubeadmin' user. This would allow you to impersonate that user and perform privileged actions, potentially leading to full compromise of the creator's account resources, including unauthorized data access, modification, or service disruption.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the Kubernetes cluster secret 'cloudstack-secret' in the 'kube-system' namespace contains the API key and secret key of the 'kubeadmin' user of the creator's account. Use the following command to inspect the secret: `kubectl --kubeconfig kube.conf -n kube-system get secret cloudstack-secret -o yaml`. If the secret contains the creator's 'kubeadmin' API and secret keys, the cluster is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, follow these steps: 1) Create a new service account with the role 'Project Kubernetes Service Role' named 'kubeadmin-<FIRST_EIGHT_CHARACTERS_OF_PROJECT_ID>'. 2) Add this service account to the project hosting the Kubernetes cluster(s). 3) Generate API and secret keys for this new service account. 4) Create a temporary file '/tmp/cloud-config' with the new service account's API URL, API key, secret key, and project ID. 5) Delete the existing 'cloudstack-secret' in the Kubernetes cluster using: `kubectl --kubeconfig kube.conf -n kube-system delete secret cloudstack-secret`. 6) Create a new secret with the updated credentials using: `kubectl --kubeconfig kube.conf -n kube-system create secret generic cloudstack-secret --from-file=/tmp/cloud-config`. 7) Remove the temporary file. 8) Regenerate API and secret keys for the original user account that created the Kubernetes cluster. Additionally, upgrade CKS to version 4.19.3.0 or 4.20.1.0 which contains the fix.