CVE-2026-62440
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. Affects versions from 4.21.0.0 through 4.22.1.0.
Risk Assessment
Allows unauthorized access to other tenants' Kubernetes clusters, potentially breaking isolation and leading to resource takeover.
Recommendation
Upgrade to version 4.22.1.1 or later, which fixes the issue.
Original NVD description (English source)
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.