CVE-2026-50112

CVE-2026-50112 is an SSRF in Apache CloudStack's KVM template download chain that enables cross-tenant hypervisor root compromise. The vulnerability lives in how CloudStack handles metalink files — XML documents that specify redundant download sources for templates. When a user registers a template with `directDownload=true`, the management server validates the outer URL against a scheme allowlist (http/https). But when the KVM agent later downloads the metalink file and follows its inner URLs to fetch the actual template bits, that validation doesn't apply. The agent trusts the metalink's inner URLs without re-checking them against the allowlist. This is a trust boundary collapse: validation performed at registration time is architecturally scoped to the entry point URL and never propagates to nested operations the agent performs. The privilege implications are severe. The attack works from a default User role — the lowest tier in CloudStack's RBAC model, sandboxed to its own account. By registering a template with a metalink containing URLs to internal NFS mounts, CloudStack APIs, or metadata services, an attacker escapes the tenant boundary and reaches the compute infrastructure layer. The KVM agent runs as root. Downloaded content becomes a template. Templates execute during VM instantiation. Low-privilege tenant actions can trigger root-level host operations — the privilege floor is inverted. Affected versions are 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Patches are available in 4.20.3.1 and 4.22.1.1. Apply them immediately to management servers. However, patching alone is insufficient. The vulnerable window spans years of template registrations — any template downloaded via metalink during that period could have been malicious. These templates persist in secondary storage across zones and do not become safe simply because you upgraded. Organizations must determine the provenance of every template registered during the vulnerable window, which most operators lack the instrumentation to audit. This is the vulnerability's deepest shadow: you can be fully patched and sitting on a hypervisor already compromised through a template downloaded months ago that looked legitimate. For defenders: prioritize management server patches, then agent patches (if the re-validation lives server-side, agents may remain vulnerable longer). Audit NFS and secondary storage for unexpected template objects. Monitor KVM agent outbound connections to internal addresses — any agent making unexpected calls to metadata services or internal APIs is a high-fidelity indicator. Segment management traffic from compute traffic. The blast radius is proportional to tenant density per host — densified compute environments face proportionally larger exposure.

Reviewed through automated stages and approved by a human before publication.