CVE-2026-59085

A Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module allows exploitation via webhook delivery requests, requiring no authentication and no user interaction. Affected versions are 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . The CVSS v3.1 score is 9...

CVE-2026-59655

Apache CloudStack's OAuth authentication plugin exposes OAuth provider client secrets to unauthenticated actors when listing OAuth providers. This information disclosure vulnerability affects versions 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 , and is rated CVSS 7.5 (HIGH) with a ne...

CVE-2026-61398

Apache CloudStack is affected by a Cross-Site Scripting (XSS) vulnerability (Improper Encoding or Escaping of Output) in the Instance Reset Password functionality of its UI. The flaw allows a remote, unauthenticated attacker to inject malicious scripts via the reset password feature, with high im...

CVE-2026-62440

CVE-2026-62440 is an Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin . It allows cross-tenant manipulation of a Kubernetes cluster during node add/remove operations, meaning one tenant can affect another tenant's cluster. Affected versions are 4.21.0.0...

CVE-2026-68745

Apache CloudStack versions 4.20.3.0 and 4.22.1.0 (all platforms) suffer from certificate validation failures in their SAML authentication flow. The root cause is that SAML2 signature validation is silently skipped when the Identity Provider (IdP) is configured without a certificate. This allows a...

CVE-2026-59799

Apache CloudStack is affected by an improper privilege management flaw in its Two-Factor Authentication plugin , specifically a missing privilege check in the 2FA disable flow that allows it to be bypassed. The vulnerability affects versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0...

CVE-2025-66170

The CVE affects the CloudStack Backup plugin (versions 4.21.0.0 and 4.22.0.0). An improper authorization logic lets any authenticated user with access to the plugin’s APIs list backups from any account, though they cannot view the backup contents. The issue is resolved by upgrading to version 4.2...

CVE-2026-50222

Apache CloudStack userdata-related APIs (deleteUserData , linkUserDataToTemplate , resetUserDataForVirtualMachine , deployVirtualMachine , and updateVirtualMachine ) exhibit missing or insufficient access control validation , potentially allowing cross-tenant/cross-account access to userdata reso...

CVE-2026-59657

CVE-2026-59657 is a Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack 's AsyncJob database storage. The issue allows sensitive information to be exposed in plaintext within the database. Affected versions span 4.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . The ...

CVE-2026-59780

Apache CloudStack 's LDAP authentication plugin exposes sensitive LDAP provider configuration details through the listLdapConfigurations API, which is accessible by default to all standard user roles. This affects versions 4.2.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . An attacker with ...

CVE-2026-61422

Apache CloudStack (versions 4.20.3.0 and 4.21.0.0 through 4.22.1.0) is affected by an authenticated pre-validation SSRF in its template and ISO registration functionality. When a user registers a template or ISO, CloudStack issues a live HTTP HEAD/GET request to determine file size for secondary ...

CVE-2026-66721

Apache CloudStack has a missing authorization flaw in its listHostTags API . Domain Admins can invoke this API by default, but the endpoint returns host tags for every host in the environment rather than being scoped to the admin's own domain. This exposes host tag information across domain bound...

CVE-2026-61399

Apache CloudStack is affected by an Improper Encoding or Escaping of Output vulnerability (classified as Cross-Site Scripting ) in the UI Lock User Functionality . The flaw allows an attacker with high privileges to inject unescaped output when locking a user, with the XSS executing in a changed ...

CVE-2026-65613

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an access control flaw in the Webhook module . The issue allows an unauthorized actor to list and delete webhook deliveries , leading to exposure of sensitive information . The vulnerability require...

CVE-2026-66722

CVE-2026-66722 is an improper authorization flaw in Apache CloudStack affecting versions 4.15.0.0–4.20.3.0 and 4.21.0.0–4.22.1.0 . The root cause is that CRUD operations on Project Roles and Project Role Permissions only verify the caller is a Domain Admin, without checking whether the target pro...