CVE-2026-59780

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59780", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-07T08:02:45.436Z", "datePublished": "2026-08-21T08:27:16.849Z", "dateUpdated": "2026-08-25T19:23:16.262Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.20.3.0", "status": "affected", "version": "4.2.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.22.1.0", "status": "affected", "version": "4.21.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "\u0141ukasz Bawolski <Lukasz.Bawolski@exea.pl>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.</p><p></p><div><div><div><div></div></div></div></div><div><div><div><div><div><div><div><p>LDAP configurations can be listed by any authenticated user with access to the <em>listLdapConfigurations</em> API. By default, this API is available to all default roles.</p></div></div></div></div></div></div></div><p></p><p>This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"}], "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-21T08:27:16.849Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CloudStack: LDAP provider configuration disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T19:22:57.714681Z", "id": "CVE-2026-59780", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:23:16.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-59780", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:22:57.714681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:23:12.327Z"}}], "cna": {"title": "Apache CloudStack: LDAP provider configuration disclosure", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "\u0141ukasz Bawolski <Lukasz.Bawolski@exea.pl>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.2.0.0", "versionType": "semver", "lessThanOrEqual": "4.20.3.0"}, {"status": "affected", "version": "4.21.0.0", "versionType": "semver", "lessThanOrEqual": "4.22.1.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.</p><p></p><div><div><div><div></div></div></div></div><div><div><div><div><div><div><div><p>LDAP configurations can be listed by any authenticated user with access to the <em>listLdapConfigurations</em> API. By default, this API is available to all default roles.</p></div></div></div></div></div></div></div><p></p><p>This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-21T08:27:16.849Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59780", "state": "PUBLISHED", "dateUpdated": "2026-08-25T19:23:16.262Z", "dateReserved": "2026-07-07T08:02:45.436Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-21T08:27:16.849Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.20.3.0", "status": "affected", "version": "4.2.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.22.1.0", "status": "affected", "version": "4.21.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9798C87-9BC3-4EFE-BD41-D94ECC75CF75", "versionEndExcluding": "4.20.3.1", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "D603F400-5DA6-4A5C-BE58-91F137F8983C", "versionEndExcluding": "4.22.1.1", "versionStartIncluding": "4.21.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}, {"lang": "es", "value": "Exposici\u00f3n de Informaci\u00f3n Sensible a un Actor No Autorizado vulnerabilidad en el plugin de autenticaci\u00f3n LDAP de Apache CloudStack al listar proveedores LDAP.\n\nLas configuraciones LDAP pueden ser listadas por cualquier usuario autenticado con acceso a la API listLdapConfigurations. Por defecto, esta API est\u00e1 disponible para todos los roles predeterminados.\n\nEste problema afecta a Apache CloudStack: desde 4.2.0.0 hasta 4.20.3.0 y desde 4.21.0.0 hasta 4.22.1.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.20.3.1 o 4.22.1.1 o posterior, que corrige el problema."}], "id": "CVE-2026-59780", "lastModified": "2026-10-16T15:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59780", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T19:22:57.714681Z", "version": "2.0.3"}}]}, "published": "2026-08-21T09:16:38.770", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0.0,4.20.3.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.21.0.0,4.22.1.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache CloudStack", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_cloudstack", "vendor": "apache"}], "created": "2026-08-21T09:30:08.487647+00:00", "updated": "2026-08-25T22:00:13.438398+00:00", "vendors": ["apache", "apache$PRODUCT$apache_cloudstack"]}