CVE-2026-62440CWE-284broken-access-control

CVE-2026-62440

Critical · published August 21, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.

This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-21T13:16Z
Affected products (1)
ProductVersionsFixed in
apache/cloudstack≥ 4.21.0.0, < 4.22.1.14.22.1.1
References (1)
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc · [email protected]
EPSS history
Timeline
  • 21 AUG 08:23Z
    Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
    cvelistv5