CVE-2026-50112
published 2026-08-21CVE-2026-50112: SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal…
PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.72%
52.3th percentile
SSRF via Metalink Mirror URL Resolution:
An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.
RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:
An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.
When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.
These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cloudstack | >= 4.14.0.0 < 4.20.3.1 | 4.20.3.1 |
| apache | cloudstack | >= 4.21.0.0 < 4.22.1.1 | 4.22.1.1 |
| apache_software_foundation | apache_cloudstack | 4.14.0.0 – 4.20.3.0 | — |
| apache_software_foundation | apache_cloudstack | 4.21.0.0 – 4.22.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache CloudStack up to 4.20.3.0/4.22.1.0 KVM Agent server-side request forgery (WID-SEC-2026-2962)
vuldb·2026-08-24·CVSS 8.8
CVE-2026-50112 [HIGH] Apache CloudStack up to 4.20.3.0/4.22.1.0 KVM Agent server-side request forgery (WID-SEC-2026-2962)
A vulnerability marked as critical has been reported in Apache CloudStack up to 4.20.3.0/4.22.1.0. This affects an unknown part of the component KVM Agent. The manipulation leads to server-side request forgery.
This vulnerability is referenced as CVE-2026-50112. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets.
ghsa_unreviewed·2026-08-21
CVE-2026-50112 [HIGH] CWE-78 SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets.
SSRF via Metalink Mirror URL Resolution:
An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.
RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:
An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.
When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and disp
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-21
Published