Is CVE-2025-66467 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66467 being exploited in the wild.

How severe is CVE-2025-66467?

High severity, with a CVSS score of 8, published 8 May 2026.

Which products and versions are affected?

Apache CloudStack 4.19.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0.

Is there a fix for CVE-2025-66467?

A patch was published on 2026-05-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66467 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-66467?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66467: Apache CloudStack incomplete cleanup in MinIO bucket deletion

CVE-2025-66467 · Severity: high · CVSS 8 · Published 2026-05-08

Apache CloudStack, an open-source platform for managing cloud computing environments, contains a flaw in how it handles MinIO storage buckets. When a user deletes a storage bucket, the system fails to properly clear the associated access policies. This allows a former owner to use their old credentials to gain unauthorized read and write access if a new bucket is later created with the same name by a different user.

Quick answers

Is CVE-2025-66467 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66467 being exploited in the wild.
How severe is CVE-2025-66467?: High severity, with a CVSS score of 8, published 8 May 2026.
Which products and versions are affected?: Apache CloudStack 4.19.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0.
Is there a fix for CVE-2025-66467?: A patch was published on 2026-05-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66467 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-66467?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as Incomplete Cleanup (CWE-459) exists in Apache CloudStack's integration with MinIO storage. When a bucket is deleted via CloudStack, the underlying MinIO access policies are not removed. If a subsequent user creates a bucket with an identical name, the original owner's access and secret keys remain valid for the new resource. An attacker with prior ownership of a bucket name can thus achieve unauthorized data exfiltration or modification. The issue is resolved in Apache CloudStack versions 4.20.3.0 and 4.22.0.1.

Affected products

Apache CloudStack 4.19.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0

Timeline

2026-05-08: disclosed
2026-05-08: advisory
2026-05-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.