CVE-2026-50112
Received Received - Intake

Remote Code Execution in Apache CloudStack via Metalink

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Apache Software Foundation

Description
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs. RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads: An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API. When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist. These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-50112
EUVD
EUVD-2026-63847

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache cloudstack From 4.14.0.0 (inc) to 4.20.3.0 (inc)
apache cloudstack From 4.21.0.0 (inc) to 4.22.1.0 (inc)
apache cloudstack 4.20.3.1
apache cloudstack 4.22.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves two related issues in Apache CloudStack. First, an authenticated user can register a template pointing to a malicious metalink file containing internal targets, causing the Secondary Storage VM to retrieve and store the file. Second, an authenticated user with default User role can execute arbitrary shell commands as root on the KVM hypervisor hosting other tenants' VMs by registering a VM template with a metalink file URL. The inner URLs in the metalink XML are not checked against allowed schemes.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized metalink file registrations and validating network requests. Monitor CloudStack logs for template registrations with directDownload=true and URLs pointing to .metalink files. Inspect KVM hypervisor hosts for unexpected shell command execution or NFS access patterns. Check for internal network targets being accessed by the Secondary Storage VM.

Impact Analysis

If exploited, this vulnerability allows an attacker to access internal systems via SSRF, retrieve malicious files, and execute arbitrary commands as root on the KVM hypervisor. This could lead to data breaches, unauthorized access to other tenants' VMs, and potential compromise of the entire cloud infrastructure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized data access, potential data breaches, and lack of proper access controls. It undermines data protection requirements and could result in legal penalties or loss of certification.

Mitigation Strategies
  • Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later to fix the issue.
  • Review and restrict user roles to prevent unauthorized template registrations.
  • Monitor network traffic for unexpected metalink file downloads or internal target access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50112. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart