Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor host

Impact

The NAS backup provider passes repository mount options straight through without sanitisation, so an account with operator privileges can plant shell metacharacters in a backup repository definition. The injected command runs on the KVM hypervisor host the next time any account performs a backup restore - a delayed trigger fired by a different, innocent user. That is code execution on the hypervisor itself, underneath every VM it hosts, including any guest with passed-through GPUs; recovering means treating the host as compromised and draining it. The vulnerable APIs exist since 4.20.0.0 (addBackupRepository) and 4.22.0.0 (updateBackupRepository).

Who can reach it

An authenticated CloudStack operator (admin-level) account able to call addBackupRepository or updateBackupRepository. Execution happens later, on the hypervisor host, when any account runs a backup restore - the attacker does not need hypervisor access themselves.

What to do

Upgrade CloudStack to 4.20.3.1 or 4.22.1.1 or later; affected ranges are 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. This is a management-server upgrade and restart rather than a hypervisor reboot, but audit existing backup repository definitions for injected options before the first restore after upgrading, and review operator accounts and hypervisor hosts that have run restores.

References

Related entries

• DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored
• Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLBCVE-2026-64229 · Linux x86/mm - broadcast TLB flush with PCID disabledUnscored
• Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT): The ccp driver initialised SNP from the SNP_COMMIT ioctlCVE-2026-64309 · Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT)Unscored
• Linux iommu/amd - IRQ-unsafe locking in guest domain allocation: An IRQ-unsafe lock taken during AMD IOMMU guest domainCVE-2026-68347 · Linux iommu/amd - IRQ-unsafe locking in guest domain allocationUnscored
• Linux perf/x86/amd/core - Branch Sampling enabled from the SVM reload path: Branch Sampling and Last Branch RecordCVE-2026-72325 · Linux perf/x86/amd/core - Branch Sampling enabled from the SVM reload pathUnscored
• Linux kernel NFSv4 client: a delayed FREE_STATEID can use a freed nfs_serverCVE-2026-74730 · Linux kernel NFSv4 client (nfs_server lifetime across FREE_STATEID)Unscored