Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 65

Export CSV
CVE-2025-59302

Apache CloudStack: Potential remote code execution on Javascript engine defined rules

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-66797

Apache CloudStack: Unauthorised comment creation and disclosure

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Cloudstack Cloudstack
CVE-2026-68745

Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures. Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-61400

Apache CloudStack: Get and Run Diagnostics Command Injection

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router. The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-61422

Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-62440

Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Cloudstack Cloudstack
CVE-2026-65613

Apache CloudStack: Webhook Deliveries Incorrect Access

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-66721

Apache CloudStack: Authorization issue with listHostTags for domain admins

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Cloudstack Cloudstack
CVE-2026-66722

Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project roles and permissions across unrelated domains. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-59654

Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server. This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-59085

Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module

Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-50222

Apache CloudStack: Improper access control in Userdata reference APIs

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-59655

Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-59657

Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob

Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-59780

Apache CloudStack: LDAP provider configuration disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles. This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Cloudstack Cloudstack
CVE-2026-59799

Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-61397

Apache CloudStack: OAuth2 Token Cross-Request Leak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Cloudstack Cloudstack
CVE-2026-61398

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2026-61399

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Cloudstack Cloudstack
CVE-2026-50112

Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs. RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads: An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API. When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist. These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Cloudstack