Apache
Apache Cloudstack: vulnerabilities and CVEs
Apache Cloudstack has 65 published vulnerabilities, 29 of them in the last 12 months. 12 are rated critical and 0 are listed by CISA as actively exploited.
CVEs65
Last 12 months29
Critical12
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-59654 | Medium (6.8) | 0.59% | — | Aug 21, 2026 | Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server,… |
| CVE-2026-68745 | High (8.1) | 0.20% | — | Aug 21, 2026 | Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof… |
| CVE-2026-66797 | Medium (5.4) | 0.46% | — | Aug 21, 2026 | Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is… |
| CVE-2026-66722 | High (7.2) | 0.62% | — | Aug 21, 2026 | Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions… |
| CVE-2026-66721 | Low (2.7) | 0.48% | — | Aug 21, 2026 | Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the… |
| CVE-2026-65613 | Medium (4.3) | 0.45% | — | Aug 21, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0… |
| CVE-2026-62440 | Critical (9.1) | 0.54% | — | Aug 21, 2026 | Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache… |
| CVE-2026-61422 | Medium (4.3) | 0.41% | — | Aug 21, 2026 | Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size… |
| CVE-2026-61400 | High (8.8) | 2.9% | — | Aug 21, 2026 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated… |
| CVE-2026-61399 | Medium (4.8) | 0.50% | — | Aug 21, 2026 | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through… |
| CVE-2026-61398 | Critical (9.1) | 0.57% | — | Aug 21, 2026 | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0… |
| CVE-2026-61397 | High (7.5) | 0.60% | — | Aug 21, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through… |
| CVE-2026-59799 | High (8.8) | 0.60% | — | Aug 21, 2026 | Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0… |
| CVE-2026-59780 | High (7.5) | 0.60% | — | Aug 21, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with… |
| CVE-2026-59657 | High (7.5) | 0.34% | — | Aug 21, 2026 | Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.… |
| CVE-2026-59655 | High (7.5) | 0.60% | — | Aug 21, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through… |
| CVE-2026-59085 | Critical (9.1) | 0.59% | — | Aug 21, 2026 | Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0… |
| CVE-2026-50222 | High (7.5) | 0.54% | — | Aug 21, 2026 | Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including… |
| CVE-2026-50112 | High (8.8) | 0.72% | — | Aug 21, 2026 | SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and… |
| CVE-2026-47359 | High (8.8) | 2.0% | — | Aug 21, 2026 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and… |
| CVE-2026-25199 | Critical (9.1) | 0.50% | — | May 8, 2026 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack… |
| CVE-2026-25077 | High (8.8) | 0.73% | — | May 8, 2026 | Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can… |
| CVE-2025-69233 | Medium (5.3) | 0.43% | — | May 8, 2026 | Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for… |
| CVE-2025-66467 | High (8.1) | 0.37% | — | May 8, 2026 | Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners… |
| CVE-2025-66172 | High (8.1) | 0.51% | — | May 8, 2026 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have… |
| CVE-2025-66171 | Medium (6.5) | 0.53% | — | May 8, 2026 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have… |
| CVE-2025-66170 | Medium (6.5) | 0.49% | — | May 8, 2026 | The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and… |
| CVE-2025-59454 | Medium (4.3) | 0.36% | — | Nov 27, 2025 | In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were… |
| CVE-2025-59302 | Medium (4.7) | 0.46% | — | Nov 27, 2025 | In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. This issue affects Apache CloudStack: from 4.18.0 before… |
| CVE-2025-30675 | Medium (4.7) | 0.67% | — | Jun 11, 2025 | In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along… |