Executive brief
Apache CloudStack, an open-source platform for managing cloud computing environments, contains a flaw in how it handles MinIO storage buckets. When a user deletes a storage bucket, the system fails to properly clear the associated access policies. This allows a former owner to use their old credentials to gain unauthorized read and write access if a new bucket is later created with the same name by a different user.
Technical details
A vulnerability classified as Incomplete Cleanup (CWE-459) exists in Apache CloudStack's integration with MinIO storage. When a bucket is deleted via CloudStack, the underlying MinIO access policies are not removed. If a subsequent user creates a bucket with an identical name, the original owner's access and secret keys remain valid for the new resource. An attacker with prior ownership of a bucket name can thus achieve unauthorized data exfiltration or modification. The issue is resolved in Apache CloudStack versions 4.20.3.0 and 4.22.0.1.
Affected products
- Apache CloudStack 4.19.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched