Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.

An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.



The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.


This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Published: 2026-08-21
Score: 8.8 High
EPSS: 1.5% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Apache CloudStack permits authenticated administrators to invoke getDiagnosticsData or runDiagnostics APIs. Because these endpoints fail to neutralize special elements properly, they are vulnerable to command injection. An attacker with administrative privileges can execute arbitrary shell commands on the underlying system VM or virtual router as root or the diagnostics-process user, granting full control over the instance and potential lateral movement within the CloudStack environment.

Affected Systems

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected. All builds within these version ranges contain the vulnerability. The issue is limited to API endpoints that require administrator permissions.

Risk and Exploitability

The high CVSS score of 8.8 reflects the impact of arbitrary command execution as root. The EPSS score is 1%, indicating a moderate probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. The vulnerability is exploitable via the management server’s API, over the network. The likely attack vector is an authenticated API call to getDiagnosticsData or runDiagnostics, as inferred from the description. An attacker with administrative privileges could execute commands on system VMs or virtual routers. Based on the description, it is inferred that environments with shared or weak admin credentials would be at increased risk.

Generated by OpenCVE AI on August 21, 2026 at 19:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or any later release that contains the fix for the command injection vulnerability.
  • If an immediate upgrade cannot be performed, limit access to the getDiagnosticsData and runDiagnostics APIs to only the accounts that absolutely require them, and consider disabling these endpoints for non-administrator roles.
  • Enforce strict role-based access control and ensure that only trusted administrators possess the permission to invoke diagnostics, thereby reducing the attack surface.
  • Apply all available security patches to the operating system of the management server, system VMs, and virtual routers to reduce the risk even if the API remains vulnerable.

Generated by OpenCVE AI on August 21, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache cloudstack
Vendors & Products Apache
Apache cloudstack

Fri, 21 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router. The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Title Apache CloudStack: Get and Run Diagnostics Command Injection
Weaknesses CWE-77
References

Subscriptions

Apache Cloudstack
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-22T03:56:24.167Z

Reserved: 2026-07-09T08:22:08.817Z

Link: CVE-2026-61400

cve-icon Vulnrichment

Updated: 2026-08-21T17:28:08.300Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-21T09:16:39.717

Modified: 2026-08-27T14:39:17.247

Link: CVE-2026-61400

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:00:13Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')