CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either getDiagnosticsData or...

CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either getDiagnosticsData or...

CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

EUVD-2026-63836

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422

An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in Apache CloudStack versions 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . The flaw resides in the template and ISO registration functionality , where the system performs a live HTTP HEAD/GET call to determine file size for seco...

CVE-2026-62440

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

EUVD-2026-63835

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-62440

An Improper Access Control vulnerability exists in the Kubernetes Service (CKS) plugin of Apache CloudStack , affecting versions 4.21.0.0 through 4.22.1.0 . This flaw allows for cross-tenant manipulation of the Kubernetes cluster specifically during the processes of adding and removing nodes . To...

CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

EUVD-2026-63834

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-65613

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-65613

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The flaw resides in the Webhook module and occurs specifically while listing and deleting deliveries , potentially allowi...