CVE-2026-65613: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-66797: Improper Access Control

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

PT-2026-79323

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.19.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Exposure of sensitive information to an unauthorized actor occurs within the OAuth2 authentication plugin and Google OAuth...

CVE-2026-61399: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...

CVE-2026-62440: Improper Access Control

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

PT-2026-79326

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Command Injection occurs in the run and get diagnostics functionality for system VMs and virtual routers. An authenticated us...

PT-2026-79322

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication...

CVE-2026-59654: Missing Release of Resource after Effective Lifetime

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

PT-2026-79315

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An OS Command Injection issue exists in the NAS backup provider plugin. The 'addBackupRepository' and 'updateBackupRepository...

CVE-2026-68745: Improper Verification of Cryptographic Signature

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the...

CVE-2026-66722: Improper Authorization

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...

CVE-2026-66721: Missing Authorization

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...

CVE-2026-47359: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...

CVE-2026-59657: Cleartext Storage of Sensitive Information

Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, whi...

PT-2026-79327

Name of the Vulnerable Software and Affected Versions Apache CloudStack version 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An authenticated Server-Side Request Forgery SSRF exists in the template and ISO registration functionality. When registering a template or ISO...

PT-2026-79321

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP...

PT-2026-79320

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Sensitive information is stored in cleartext within the database when using AsyncJob storage. Recommendations Upgrade Apache...

PT-2026-79329

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the Webhook module allows the exposure of sensitive information to unauthorized actors during the process of...

CVE-2026-61400: Improper Neutralization of Special Elements used in a Command

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either getDiagnosticsData or...

PT-2026-79317

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Insufficient access control validation in several userdata-related APIs may allow unauthorized cross-tenant or cross-account...