Description

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs. RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads: An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API. When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist. These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T09:16:38.150Z",
  "pubdate": "2026-08-21T09:16:38.150Z",
  "executiveSummary": "A severe security vulnerability exists in Apache CloudStack involving Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) on KVM hypervisors via Metalink mirror URL resolution.\nAn authenticated tenant holding the default User role can exploit this flaw to execute arbitrary shell commands as root on the underlying KVM hypervisor host running other tenants' VMs, resulting in cross-tenant compromise.\nThe vulnerability affects Apache CloudStack versions from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\nExploitation requires an authenticated user to register a VM template with directDownload set to true and a URL pointing to a malicious .metalink file.\nThe risk implications include complete infrastructure compromise, data exfiltration, and unauthorized access across multiple tenant boundaries via the public CloudStack API.\nUsers are strongly advised to upgrade to version 4.20.3.1 or 4.22.1.1 or later to remediate the issue.",
  "technicalDetails": "The vulnerability stems from improper validation and lack of scheme allowlist re-validation for inner URLs contained within Metalink XML files during VM template registration.\nThe vulnerable components involve the Management Server, Secondary Storage VM, and the KVM agent.\nAuthentication and privilege requirements involve an authenticated tenant holding the default User role interacting with the public CloudStack API.\nThe attack flow begins when an authenticated tenant registers a template pointing to an attacker-controlled metalink file containing internal targets or malicious payloads.\nWhen a user registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches the download instruction to the KVM agent.\nBecause inner URLs inside the metalink XML are never re-validated against the scheme allowlist, the Secondary Storage VM retrieves the data and persists it as a template file.\nThis behavior facilitates SSRF, allowing access to internal targets through the storage subsystem.\nFurthermore, by leveraging direct downloads and malicious metalink structures, execution can be triggered on the KVM hypervisor host.\nThe post-exploitation impact includes arbitrary shell command execution as root on the KVM hypervisor host, enabling complete cross-tenant compromise on the underlying compute infrastructure."
}