CVE-2026-59655: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Apache Software Foundation Apache CloudStack

This vulnerability (CVE-2026-59655) in Apache CloudStack involves exposure of sensitive information due to improper handling in the OAuth authentication plugin during the listing of OAuth providers. The flaw affects multiple versions spanning 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability are not affected. The Apache Software Foundation has released fixed versions 4.20.3.1 and 4.22.1.1 to address this issue.

An attacker without any privileges or user interaction can remotely exploit this vulnerability to gain access to sensitive information exposed by the OAuth authentication plugin in Apache CloudStack. This could lead to unauthorized disclosure of confidential data, potentially impacting the security posture of affected deployments.

Users should upgrade affected Apache CloudStack installations to versions 4.20.3.1 or 4.22.1.1 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.