CVE-2025-22828

Apache CloudStack versions 4.16.0 and later are affected by a broken access control vulnerability (CWE-200) caused by an access validation issue. This flaw allows users with knowledge of resource UUIDs —which may be exposed in various parts of the application—to list or add comments (annotations)...

CVE-2022-26779

CVE-2022-26779 (Apache CloudStack) affects CloudStack versions prior to 4.16.1.0, where project invitation tokens were generated with insecure randomness when an invite is created based on an email address. The root cause is the insecure RNG, enabling an attacker who knows the project ID and that...

CVE-2024-41107

CVE-2024-41107 — Apache CloudStack: SAML Signature Exclusion Root cause: CloudStack’s SAML authentication can bypass signature checks when SAML is enabled, allowing spoofed, unsigned SAML responses to authenticate as a legitimate SAML-enabled user. Impact: In affected environments, an attacker ca...

CVE-2025-47849

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 . A malicious Domain Admin user in the ROOT domain can obtain the API key and secret key of user-accounts with an Admin role type within the same domain due to insufficient operational restrictions...

CVE-2024-39864

The CVE-2024-39864 issue affects Apache CloudStack's Integration API service. When integration.api.port is set to 0 (default), an improper initialisation causes the unauthenticated integration API server to listen on a random port. An attacker with access to the CloudStack management network coul...

CVE-2024-29006

The CVE-2024-29006 issue affects the CloudStack management server, where the system by default accepts and logs the x-forwarded-for header as the source IP for API requests. This misconfiguration can enable authentication bypass and other operational problems if an attacker spoofs their IP. Publi...

CVE-2025-26521

Apache CloudStack versions prior to 4.19.3.0 and 4.20.1.0 are vulnerable to an information disclosure flaw where the API key and secret key of the 'kubeadmin' user are improperly exposed. When a user-account creates a CKS-based Kubernetes cluster in a project, these credentials are used to create...

CVE-2025-47713

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 due to improper privilege management. A malicious Domain Admin user in the ROOT domain can bypass restrictions to reset the passwords of user-accounts with an Admin role type . This allows an attac...

CVE-2024-42222

CVE-2024-42222 affects Apache CloudStack 4.19.1.0, where a regression in the network listing API allows unauthorised listing of network details for domain admins and normal users, compromising tenant isolation and potentially exposing network configurations and data. The issue has been fixed in C...

CVE-2024-42062

CVE-2024-42062 (Apache CloudStack) : A permission validation flaw in CloudStack 4.10.0–4.19.1.0 lets domain-admins query all account-user API/secret keys, including those of root admins. An attacker with domain-admin access can leverage this to gain root-admin and other privileges, potentially co...

CVE-2022-35741

The CVE-2022-35741 issue affects Apache CloudStack 4.5.0 and later, specifically the SAML 2.0 authentication Service Provider plugin. The vulnerability is XML External Entity (XXE) injection in the XML-based SAML messages parsed during authentication. Attacker must have the plugin enabled (not en...

CVE-2024-38346

CVE-2024-38346 affects Apache CloudStack’s cluster service that runs on an unauthenticated port (default 9090). The provided documents describe a code-injection vulnerability enabling remote code execution on targeted hypervisors and CloudStack management server hosts, potentially leading to comp...

CVE-2024-29007

Apache CloudStack is vulnerable to a Server-Side Request Forgery (SSRF) via a security bypass. The management server and secondary storage VM (SSVM) can be tricked into making requests to restricted or random resources because they follow 301 HTTP redirects provided by external servers during the...

CVE-2025-30675

CVE-2025-30675 in Apache CloudStack affects the listTemplates and listIsos APIs due to a flawed access-control check when domainid is specified with filters self or selfexecutable. The issue allows a Domain Admin or Resource Admin to enumerate templates/ISOs in unrelated domains, breaching isolat...

CVE-2024-50386

CVE-2024-50386 affects Apache CloudStack where by default, derived KVM-compatible templates can be registered for download to primary storage. The root cause is missing validation checks for KVM templates in CloudStack versions 4.0.0–4.18.2.4 and 4.19.0–4.19.1.2. An attacker able to register temp...

CVE-2024-29008

Apache CloudStack is affected by an input validation error in the additional VM configuration (extraconfig) feature. This vulnerability allows users with privileges to deploy or configure VM instances to bypass administrative restrictions and enable the extraconfig feature. In KVM-based environme...

CVE-2024-45693

The CVE-2024-45693 issue affects Apache CloudStack where missing validation of the origin of requests enables Cross-Site Request Forgery in the web interface. This could allow an attacker to impersonate an authenticated user and gain privileges, potentially leading to account takeover and exposur...

CVE-2024-45219

Apache CloudStack CVE-2024-45219 concerns a KVM-related vulnerability where default user uploads/registrations of templates and volumes can bypass validation for KVM-compatible disks. The issue spans CloudStack versions 4.0.0–4.18.2.3 and 4.19.0.0–4.19.1.1, allowing an attacker who can upload or ...

CVE-2024-45462

The CVE describes an incomplete session invalidation in Apache CloudStack that allows a user with browser access to reuse an unexpired session after logout. Affected versions: 4.15.1.0–4.18.2.3 and 4.19.0.0–4.19.1.1. Mitigation per connected documents: upgrade to 4.18.2.4 or 4.19.1.2 (or later) d...

CVE-2016-6813

CVE-2016-6813 affects Apache CloudStack 4.1–4.8.1.0 and 4.9.0.0. The issue is an API call that lets a user register for the developer API, and if the attacker can determine another non-root user’s CloudStack ID, they may reset that user’s API keys and gain access to their account and resources. T...

CVE-2024-45461

CVE-2024-45461 affects Apache CloudStack where the Quota feature is enabled. The issue is due to missing access-check enforcements, allowing non-administrative users to access and modify quota-related configurations and data. Affected ranges include 4.7.0–4.18.2.3 and 4.19.0.0–4.19.1.1 when the Q...

CVE-2013-2758

CVE-2013-2758 affects Apache CloudStack 4.0.0–4.0.1 and Citrix CloudPlatform 3.0.x prior to 3.0.6 Patch C, which use a hash of a predictable sequence. This enables remote attackers to guess the console access URL via brute force. Remediation: upgrade to Apache CloudStack 4.0.2 or later, and Citri...

CVE-2026-66797

Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to an improper access control flaw in the annotation functionality . The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is provided but fail to honor the resul...

CVE-2013-2756

The CVE-2013-2756 issue affects Apache CloudStack 4.0.0–4.0.1 (and Citrix CloudPlatform 3.0.x up to 3.0.5) where Patch C for the respective lines allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code. The root cause is an authentication bypa...

CVE-2014-0031

Apache CloudStack (vulnerable: before 4.2.1) exposes an information disclosure via the ListNetworkACL and listNetworkACLLists APIs. The issue, caused by how crafted requests allow remote authenticated users to list network ACLs for other users, can reveal ACLs not owned by the attacker. Impact is...

CVE-2025-22829

Affected software: Apache CloudStack with the Quota plugin (version 4.20.0.0). Issue: Improper privilege management logic lets an authenticated user with access to specific APIs enable/disable quota‑related emails and list quota configurations for any account in environments where the plugin is e...

CVE-2012-5616

CVE-2012-5616 affects Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform prior to 3.0.6, where sensitive data is logged in log4j.conf. This enables local users to obtain (1) SSH private keys from createSSHKeyPair, (2) host passwords from AddHost, and (3)/(4) VM passwords from DeployVM or...

CVE-2016-3085

CVE-2016-3085 affects Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1. When SAML-based authentication is enabled, remote attackers can bypass authentication and access the user interface via vectors related to the SAML plugin. The conne...

CVE-2026-50112

Apache CloudStack versions 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to SSRF and RCE . An authenticated tenant can register a template pointing to an attacker-controlled metalink file , allowing the Secondary Storage VM to retrieve and persist data from internal targe...

CVE-2013-2136

Apache CloudStack UI contains multiple cross-site scripting (XSS) vulnerabilities in versions up to 4.1.0, allowing authenticated/remote attackers to inject arbitrary script or HTML via fields in Zone, Network, Instance, global settings, and other UI inputs. The issue is fixed by upgrading to Clo...

CVE-2013-4317

CVE-2013-4317 describes an information-disclosure vulnerability in Apache CloudStack versions 4.1.0 and 4.1.1 . When a regular, non-administrative user calls the CloudStack API operation listProjectAccounts , the user can view information for accounts other than their own. The connected Red Hat a...

CVE-2019-17562

Apache CloudStack baremetal component contains a buffer overflow (affecting all versions prior to 4.13.1) caused by inadequate validation of the mac parameter in baremetal virtual router. An attacker can inject shell commands via the mac field (example: /baremetal/provisiondone/{mac} with special...

CVE-2015-3251

CVE-2015-3251 : In Apache CloudStack, versions before 4.5.2 allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified API-call vectors. The vulnerability is an information disclosure issue tied to the API surface used ...

CVE-2026-25077

Apache CloudStack is vulnerable to an unauthenticated command injection due to missing file name sanitization when users register templates for direct download to primary storage for KVM hypervisor deployments. An attacker can register malicious templates to execute arbitrary code on KVM hosts, p...

CVE-2015-3252

Apache CloudStack vulnerability CVE-2015-3252 affects CloudStack before 4.5.2 (4.5.1 and earlier per CNVD). The issue arises from improper preservation of VNC passwords during KVM VM migrations, enabling a remote attacker to gain access by connecting to the VNC server. According to the sources, t...

CVE-2025-59302

A Code Injection vulnerability exists in Apache CloudStack due to improper control of code generation within specific administrative APIs, including quotaTariffCreate, quotaTariffUpdate, createSecondaryStorageSelector, updateSecondaryStorageSelector, updateHost, and updateStorage. The issue impac...

CVE-2026-61397

Apache CloudStack is impacted by a vulnerability where sensitive information is exposed to an unauthorized actor. The issue resides within the OAuth2 authentication plugin and the Google OAuth integration . Specifically, the vulnerability involves an OAuth2 Token Cross-Request Leak . Affected ver...

CVE-2012-4501

Summary of CVE-2012-4501 (CloudStack/Apache CloudStack) : A configuration vulnerability in development versions of CloudStack/OpenStack incubated CloudStack allowed an attacker to issue arbitrary API calls by abusing the system user account, including deleting VMs. The issue affected CloudStack c...

CVE-2013-6398

CVE-2013-6398 affects Apache CloudStack virtual routers prior to 4.2.1. After a restart, firewall rules’ source restrictions were not preserved, allowing a remote attacker to bypass restrictions and access network resources. Public sources in connected documents (NVD entry and security advisories...

CVE-2026-47359

Apache CloudStack is vulnerable to an OS Command Injection in its NAS backup provider plugin . The addBackupRepository (available since 4.20.0.0) and updateBackupRepository (introduced in 4.22.0.0) APIs accept unsanitized command options for the backup repository. A malicious operator account can...

CVE-2026-59654

Apache CloudStack's scoped global configuration functionality suffers from a resource leak (database connections not released after their effective lifetime), affecting modules such as Quota and Host-HA on the management server. Over time, the accumulated leak can lead to an eventual denial of se...

CVE-2014-7807

Apache CloudStack is affected: versions 4.3.x before 4.3.2 and 4.4.x before 4.4.2 allow unauthenticated LDAP binds when LDAP is configured, enabling login requests without a password and resulting in an unauthenticated bind. Remediation per the docs is to upgrade to 4.4.2 (or 4.3.2 in testing) or...

CVE-2026-25199

Apache CloudStack versions 4.21.0.0 through 4.22.0.0 are vulnerable to a flaw in the Proxmox extension that allows for unauthorized cross-tenant access. The extension fails to validate the user-editable instance setting proxmox_vmid against tenant ownership. Because Proxmox VM IDs are predictable...

CVE-2014-9593

Apache CloudStack is affected by CVE-2014-9593: before 4.3.2 and 4.4.x before 4.4.2, the listSslCerts API call can disclose private keys. Likely impact is information disclosure of SSL private keys. The remediation in the connected records is to upgrade to CloudStack 4.3.2+ or 4.4.2+ (i.e., fixed...

CVE-2025-66467

CVE-2025-66467 affects Apache CloudStack in scenarios where MinIO policy cleanup is not performed on bucket deletion. The issue allows previous bucket owners to retain access to buckets they formerly owned: if another user creates a bucket with the same name, those prior owners can gain unauthori...

CVE-2026-59655

Apache CloudStack is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor in its OAuth authentication plugin . The issue occurs specifically while listing OAuth providers, which can lead to the disclosure of unauthenticated OAuth provider client-secrets . This affects versi...

CVE-2026-61400

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to a Command Injection flaw in the run and get diagnostics functionality for system VMs and virtual routers. An authenticated user with the necessary permissions can invoke the getDiagnosticsData or ...

CVE-2025-69233

CVE-2025-69233 affects Apache CloudStack and describes time-of-check/time-of-use race conditions in the resource count check and increment logic, along with missing validations, that allow users to exceed allocation limits for accounts/domains. This can enable an attacker to degrade infrastructur...

CVE-2025-66171

The CloudStack Backup plugin in Apache CloudStack versions 4.21.0.0 and 4.22.0.0 contains improper access logic . An authenticated user with access to specific APIs can exploit this flaw to create new virtual machines using the backup data of any other user within the environment. To remediate th...

CVE-2025-59454

Apache CloudStack is affected by an access control error where insufficient permission validation allows authorized users to occasionally access information beyond their intended scope. This vulnerability specifically affects the createNetworkACL , listNetworkACLs , listResourceDetails , listVirt...