Apache CloudStack: MinIO policies survive bucket deletion, giving a former owner access to a new bucket of the same name

Impact

CloudStack does not remove the MinIO policy when a bucket is deleted. The access and secret keys the previous owner already holds stay valid for that bucket name, so when a different tenant later creates a bucket with the same name, the former owner reads and writes it. On a shared cluster that is cross-tenant access to object storage - the place training datasets, checkpoints and model artifacts live - and bucket names are predictable enough (team or project names) that collisions happen without the attacker doing anything clever. Write access is the sharper half: a tenant who can overwrite another tenant's checkpoints or datasets can poison training runs.

Who can reach it

Network, authenticated as an existing CloudStack user who previously owned a bucket and retained its generated access and secret keys. They then talk to the MinIO endpoint directly; no CloudStack admin rights and no access to the victim's account are needed.

What to do

Upgrade CloudStack to 4.20.3.0 or 4.22.0.1 or later, which fixes the cleanup. Upgrading the management server is a control-plane service restart, not a node drain - running instances and GPU workloads are unaffected. The fix is forward-looking: audit the existing MinIO policies for entries referencing buckets that no longer exist, or that no longer belong to the holder, and delete those plus the stale keys, otherwise already-leaked access persists after the upgrade.

References

Related entries

• N-able N-central: Incomplete patch for CVE-2026-18556CVE-2026-18577 · N-able N-centralHigh
• VMware Aria Operations (command injection during assisted migration): An unauthenticated attacker injects commandsCVE-2026-22719 · VMware Aria Operations (command injection during assisted migration)High
• OpenStack glance_store: VMware datastore driver sends authentication headers to an attacker-supplied image location hostCVE-2026-51773 · OpenStack glance_store (VMware datastore driver, _retry_request)High
• Ceph RGW: unsigned x-amz-* headers on presigned URLs are honored, letting a URL holder escalate privilegesCVE-2026-54330 · Ceph Object Gateway (RGW SigV4 presigned-URL header validation)High
• Apache Airflow Git provider: SSH host-key verification disabled by default when cloning DAG bundlesCVE-2026-58065 · Apache Airflow Git provider (apache-airflow-providers-git, git-over-SSH host key checking)High
• Apache Airflow FAB provider: a DAG named 'DAGs' collides with the global all-DAGs permission and escalates privilegesCVE-2026-59245 · Apache Airflow FAB auth manager (apache-airflow-providers-fab, resource_name collision)High