CVE-2024-29008

A problem has been identified in the Apache CloudStack additional VM configuration (extraconfig ) feature, where an input validation error allows users with privileges to deploy or configure VM instances to bypass administrator settings. In KVM-based environments, an attacker can exploit this to ...

CVE-2024-45461

CVE-2024-45461 affects Apache CloudStack where the Quota feature is enabled. The issue is due to missing access-check enforcements, allowing non-administrative users to access and modify quota-related configurations and data. Affected ranges include 4.7.0–4.18.2.3 and 4.19.0.0–4.19.1.1 when the Q...

CVE-2016-3085

CVE-2016-3085 affects Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1. When SAML-based authentication is enabled, remote attackers can bypass authentication and access the user interface via vectors related to the SAML plugin. The conne...

CVE-2025-66171

The CloudStack Backup plugin in Apache CloudStack versions 4.21.0.0 and 4.22.0.0 contains improper access logic . An authenticated user with access to specific APIs can exploit this flaw to create new virtual machines using the backup data of any other user within the environment. To remediate th...

CVE-2025-69233

CVE-2025-69233 affects Apache CloudStack and describes time-of-check/time-of-use race conditions in the resource count check and increment logic, along with missing validations, that allow users to exceed allocation limits for accounts/domains. This can enable an attacker to degrade infrastructur...

CVE-2025-66170

The CloudStack Backup plugin in versions 4.21.0.0 and 4.22.0.0 contains an improper authorization logic vulnerability. Authenticated users with account access in CloudStack environments where this plugin is enabled can leverage specific APIs to list backups from any account within the environment...