Vulnerability in Apache Cloudstack
CVE-2025-66467
Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (28.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 28.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Apache Cloudstack
- Apache Software Foundation Cloudstack — versions 4.19.0.0, 4.21.0.0
Weakness classification (CWE)
References
- lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-66467?
- CVE-2025-66467 is a high-severity vulnerability in Apache Cloudstack, classified under Incomplete Cleanup. CVSS score: 8.0/10. Published 2026-05-08.
- How severe is CVE-2025-66467?
- High severity. CVSS v3 base score is 8.0 out of 10.