Unrated severityNVD Advisory· Published Aug 21, 2026

CVE-2026-62440

Description

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.

This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.

Affected products

Apache/Cloudstackllm-fuzzy
Range: 4.21.0.0 - 4.22.1.0
Apache/Kubernetes Service (CKS) pluginllm-create
Range: 4.21.0.0 - 4.22.1.0

Patches

Vulnerability mechanics

References

lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbcnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000