From 9d7148e7ec96e7ce383fcd0a4ac9fdd8158b284e Mon Sep 17 00:00:00 2001
From: Rene Moser <resmo@apache.org>
Date: Wed, 9 Sep 2026 23:28:19 +0200
Subject: [PATCH] Fix NPE if on port 8096 getUserKeys

---
 .../com/cloud/user/AccountManagerImpl.java    | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index c06228e44f9d..1a986b1b90a6 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -3315,15 +3315,16 @@ public Pair<Boolean, Map<String, String>> getKeys(GetUserKeysCmd cmd) {
         verifyCallerPrivilegeForUserOrAccountOperations(user);
 
         String accessingApiKey = getAccessingApiKey(cmd);
-        ApiKeyPair keyPair;
+        ApiKeyPair keyPair = null;
         if (accessingApiKey != null) {
             ApiKeyPair accessingKeyPair = apiKeyPairService.findByApiKey(accessingApiKey);
-            if (userId == accessingKeyPair.getUserId()) {
-                keyPair = apiKeyPairService.findByApiKey(accessingApiKey);
-            } else {
-                keyPair = _accountService.getLatestUserKeyPair(userId);
+            if (accessingKeyPair == null) {
+                logger.debug("Unable to find the API key pair used to access the API; falling back to the latest key pair of user with ID [{}].", userId);
+            } else if (userId == accessingKeyPair.getUserId()) {
+                keyPair = accessingKeyPair;
             }
-        } else {
+        }
+        if (keyPair == null) {
             keyPair = _accountService.getLatestUserKeyPair(userId);
         }
 
@@ -3436,6 +3437,10 @@ private Boolean isAccessingKeypairSuperset(ApiKeyPair accessedKeyPair, BaseCmd c
             return Boolean.TRUE;
         }
         ApiKeyPair accessingKeyPair = apiKeyPairService.findByApiKey(apiKey);
+        if (accessingKeyPair == null) {
+            logger.info("Unable to find the API key pair used to access the API; therefore, its permissions cannot be verified.");
+            return Boolean.FALSE;
+        }
         return isApiKeySupersetOfPermission(new ArrayList<>(getAllKeypairPermissions(accessingKeyPair.getApiKey())), new ArrayList<>(getAllKeypairPermissions(accessedKeyPair.getApiKey())));
     }
 
@@ -3727,6 +3732,9 @@ public List<RolePermissionEntity> getAllKeypairPermissions(String apiKey) {
             throw new InvalidParameterValueException("API key not present in the request's URL and, thus, unable to fetch API key rules.");
         }
         ApiKeyPair apiKeyPair = keyPairManager.findByApiKey(apiKey);
+        if (apiKeyPair == null) {
+            throw new InvalidParameterValueException("Unable to find an API key pair matching the API key present in the request's URL and, thus, unable to fetch API key rules.");
+        }
         Account account = _accountDao.findById(apiKeyPair.getAccountId());
         List<ApiKeyPairPermission> keyPairPermissions = keyPairManager.findAllPermissionsByKeyPairId(apiKeyPair.getId(), account.getRoleId());
         return new ArrayList<>(keyPairPermissions);