PT-2026-38916 · Apache · Cloudstack

Published 2026-05-08 · Updated 2026-05-11 · CVE-2025-66467

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions prior to 4.20.3.0 Apache CloudStack versions prior to 4.22.0.1

Description Missing MinIO policy cleanup during bucket deletion allows users to retain access to buckets they previously owned. If a different user creates a new bucket using the same name, the previous owners can obtain unauthorized read and write access to that bucket by utilizing previously generated access and secret keys.

Recommendations Upgrade to version 4.20.3.0 or later. Upgrade to version 4.22.0.1 or later.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2025-66467

Affected Products

Cloudstack

References · 8

• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66467 · Security Note
• http://openwall.com/lists/oss-security/2026/05/09/4 · Note
• https://reddit.com/r/CVEWatch/comments/1t9ysy3/top_10_trending_cves_11052026 · Reddit Post
• https://twitter.com/CVEnew/status/2053174674951995619 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2052742824223748531 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052763185413771541 · Twitter Post
• https://t.me/cveNotify/162859 · Telegram Post