CVE-2026-66908 is an improper authentication vulnerability in the Apache Camel Platform HTTP Main component affecting versions from 4.8.0 up to but not including 4.22.0. The issue arises because the JWT authentication configuration does not enforce validation of the issuer (iss) and audience (aud) claims unless explicitly configured, allowing acceptance of any unexpired token signed by a trusted key. This can lead to acceptance of tokens intended for other services or audiences within the same trust domain. The vulnerability is fixed in version 4.22.0, which requires explicit configuration of issuer and audience claims or an explicit override to allow missing claims. Users on maintenance branches 4.14.x and 4.18.x should upgrade to versions 4.14.9 or 4.18.4 and configure these claims accordingly.
CVE-2026-66907 is a relative path traversal vulnerability in the Apache Camel Google Storage component. It affects versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability arises because the component downloads Google Cloud Storage objects to the local filesystem without properly normalizing or restricting the destination path, allowing crafted object names containing parent-directory segments to escape the intended download directory. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process. A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0.
CVE-2026-66906 is a critical relative path traversal vulnerability in the Apache Camel Azure Storage Blob component. It allows an attacker who can influence blob names in an Azure Storage container to cause Camel to write files outside the intended directory on the local filesystem. This occurs because the component does not normalize or restrict blob names containing parent-directory segments when downloading blobs to files. The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Fixed versions are available, and users are advised to upgrade to these fixed releases. Alternative mitigations include filtering blob names with regex or avoiding the vulnerable operation on untrusted containers.
A relative path traversal vulnerability exists in the Apache Camel Azure-Storage Datalake component's downloadToFile operation. This flaw allows an attacker who can influence file names in the consumed Azure Data Lake filesystem to cause Camel to write files outside the intended directory, potentially overwriting arbitrary files with the privileges of the Camel process. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective patch releases 4.14.9 or 4.18.4 mitigates this vulnerability.
Apache Camel contains an improper input validation vulnerability in its camel-mail component's MimeMultipart data format when configured with headersInline set to true. This flaw allows untrusted MIME headers to be copied as Camel message headers without filtering, potentially enabling an attacker to inject headers in the Camel-internal namespace. Such injected headers can alter the behavior of downstream route steps, depending on the route configuration. The issue affects versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should keep headersInline disabled or strip Camel-internal headers after unmarshalling.
CVE-2026-59654 is a resource management vulnerability in Apache CloudStack affecting scoped global configuration functionality across various modules and plugins. It impacts versions from 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The flaw may cause a denial of service (DoS) condition on the management server due to missing release of resources after their effective lifetime. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-63046 is a high-severity vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw involves improper neutralization of argument delimiters in a command, specifically in the Agent Installer's ModuleManager component, which executes arbitrary shell commands via ExcuteLinux.exeCmd() without filtering or whitelist validation. This allows potential command injection. Users are advised to upgrade to version 2.4.0 or apply specific patches to remediate the issue.
CVE-2026-47359 is an OS command injection vulnerability in Apache CloudStack's NAS backup provider plugin. It affects the addBackupRepository and updateBackupRepository APIs, which accept unsanitized command options. A malicious operator account can exploit this to execute arbitrary commands on the KVM hypervisor host during backup restore operations. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.
CVE-2026-50112 is a high-severity OS command injection vulnerability in Apache CloudStack affecting versions from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. An authenticated tenant can exploit this by registering a VM template with a malicious metalink file, leading to remote code execution as root on the KVM hypervisor host. The issue arises because inner URLs in metalink XML files are not properly validated against allowed schemes. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-50222 is a high-severity vulnerability in Apache CloudStack affecting userdata-related APIs. Several APIs lack proper authorization checks, allowing unauthorized access to userdata resources across tenants. Affected versions include 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue also affects the deleteCniConfiguration API introduced in 4.21.0.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59085 is a critical Server-Side Request Forgery (SSRF) vulnerability in the webhook module of Apache CloudStack. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows unauthenticated attackers to send crafted webhook delivery requests that could lead to unauthorized information disclosure and impact confidentiality and integrity. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59655 is a vulnerability in Apache CloudStack's OAuth authentication plugin that allows exposure of sensitive information to unauthorized actors when listing OAuth providers. This affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59657 is a high-severity vulnerability in Apache CloudStack that involves cleartext storage of sensitive information in the AsyncJob database storage. This affects versions from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows sensitive data to be stored without encryption, potentially exposing it to unauthorized access. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59780 is a high-severity vulnerability in Apache CloudStack's LDAP authentication plugin that allows exposure of sensitive information to unauthorized actors. The issue arises because any authenticated user with access to the listLdapConfigurations API can list LDAP configurations, and this API is by default accessible to all default roles. This affects Apache CloudStack versions from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59799 is an improper privilege management vulnerability in Apache CloudStack's two-factor authentication plugin. It allows bypassing the two-factor authentication disable flow. The issue affects Apache CloudStack versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.