CVE-2026-66721

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.12.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0

Description An authorization flaw exists in the host tags listing functionality. Domain Admins are permitted to call the 'listHostTags' API, but the system returns host tags for all hosts in the environment instead of restricting the results to hosts dedicated to the admin's specific domain.

Recommendations Upgrade versions 4.12.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.