CVE-2025-66467

CVE-2025-66467 affects Apache CloudStack in scenarios where MinIO policy cleanup is not performed on bucket deletion. The issue allows previous bucket owners to retain access to buckets they formerly owned: if another user creates a bucket with the same name, those prior owners can gain unauthori...

CVE-2026-61397

Apache CloudStack 's OAuth2 authentication plugin and Google OAuth integration are affected by an Exposure of Sensitive Information to an Unauthorized Actor vulnerability, identified as an OAuth2 Token Cross-Request Leak . The issue affects versions 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through ...

CVE-2026-59655

Apache CloudStack's OAuth authentication plugin exposes OAuth provider client secrets to unauthenticated actors when listing OAuth providers. This information disclosure vulnerability affects versions 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 , and is rated CVSS 7.5 (HIGH) with a ne...