An incomplete cleanup vulnerability in Apache CloudStack allows authenticated users with low privileges to retain unauthorized read and write access to newly created storage buckets, presenting significant data confidentiality and integrity risks.

This issue is classified as an incomplete cleanup flaw under CWE-459, occurring when bucket deletion fails to purge associated MinIO access policies, requiring low-privileged authenticated users and user interaction to exploit.

A successful exploit permits unauthorized actors to read and modify sensitive data residing in newly generated storage buckets sharing previous naming conventions. This leads to severe data compromise, regulatory non-compliance, and potential business disruption. The assigned CVSS score of 8.0 reflects high potential severity due to the high technical impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade to Apache CloudStack versions 4.20.3.0, 4.22.0.1, or later, to resolve the missing MinIO policy cleanup issue.

Proactive Monitoring: Monitor storage access logs and cloud orchestration audit trails for anomalous read and write operations targeting newly provisioned storage buckets.

Compensating Controls: Implement strict identity and access management controls alongside bucket naming conventions to prevent predictable bucket recreation.

Public Exploit Available: No — no confirmed public exploit exists in the available data.

Organizations utilizing affected versions of Apache CloudStack face substantial data exposure risks due to stale object storage permissions. Administrators must apply the vendor security updates immediately to patch the incomplete cleanup defect and secure cloud storage policies against unauthorized access.