← CVE Intelligence

CVE-2026-62440

Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation PUBLISHED

Description (CNA)

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache CloudStackaffected 4.21.0.0 through 4.22.1.0

CWE

CWE-284

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.