Threat database

A relative path traversal vulnerability exists in the Apache Camel Azure-Storage Datalake component's downloadToFile operation. This flaw allows an attacker who can influence file names in the consumed Azure Data Lake filesystem to cause Camel to write files outside the intended directory, potentially overwriting arbitrary files with the privileges of the Camel process. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective patch releases 4.14.9 or 4.18.4 mitigates this vulnerability.

Apache Camel contains an improper input validation vulnerability in its camel-mail component's MimeMultipart data format when configured with headersInline set to true. This flaw allows untrusted MIME headers to be copied as Camel message headers without filtering, potentially enabling an attacker to inject headers in the Camel-internal namespace. Such injected headers can alter the behavior of downstream route steps, depending on the route configuration. The issue affects versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should keep headersInline disabled or strip Camel-internal headers after unmarshalling.

CVE-2026-59654 is a resource management vulnerability in Apache CloudStack affecting scoped global configuration functionality across various modules and plugins. It impacts versions from 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The flaw may cause a denial of service (DoS) condition on the management server due to missing release of resources after their effective lifetime. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-63046 is a high-severity vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw involves improper neutralization of argument delimiters in a command, specifically in the Agent Installer's ModuleManager component, which executes arbitrary shell commands via ExcuteLinux.exeCmd() without filtering or whitelist validation. This allows potential command injection. Users are advised to upgrade to version 2.4.0 or apply specific patches to remediate the issue.

CVE-2026-47359 is an OS command injection vulnerability in Apache CloudStack's NAS backup provider plugin. It affects the addBackupRepository and updateBackupRepository APIs, which accept unsanitized command options. A malicious operator account can exploit this to execute arbitrary commands on the KVM hypervisor host during backup restore operations. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.

CVE-2026-50112 is a high-severity OS command injection vulnerability in Apache CloudStack affecting versions from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. An authenticated tenant can exploit this by registering a VM template with a malicious metalink file, leading to remote code execution as root on the KVM hypervisor host. The issue arises because inner URLs in metalink XML files are not properly validated against allowed schemes. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-50222 is a high-severity vulnerability in Apache CloudStack affecting userdata-related APIs. Several APIs lack proper authorization checks, allowing unauthorized access to userdata resources across tenants. Affected versions include 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue also affects the deleteCniConfiguration API introduced in 4.21.0.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-59085 is a critical Server-Side Request Forgery (SSRF) vulnerability in the webhook module of Apache CloudStack. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows unauthenticated attackers to send crafted webhook delivery requests that could lead to unauthorized information disclosure and impact confidentiality and integrity. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-59655 is a vulnerability in Apache CloudStack's OAuth authentication plugin that allows exposure of sensitive information to unauthorized actors when listing OAuth providers. This affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-59657 is a high-severity vulnerability in Apache CloudStack that involves cleartext storage of sensitive information in the AsyncJob database storage. This affects versions from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows sensitive data to be stored without encryption, potentially exposing it to unauthorized access. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-59780 is a high-severity vulnerability in Apache CloudStack's LDAP authentication plugin that allows exposure of sensitive information to unauthorized actors. The issue arises because any authenticated user with access to the listLdapConfigurations API can list LDAP configurations, and this API is by default accessible to all default roles. This affects Apache CloudStack versions from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-59799 is an improper privilege management vulnerability in Apache CloudStack's two-factor authentication plugin. It allows bypassing the two-factor authentication disable flow. The issue affects Apache CloudStack versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.

CVE-2026-61397 is a high severity vulnerability in Apache CloudStack affecting the OAuth2 authentication plugin and Google OAuth integration. It allows exposure of sensitive information to unauthorized actors. The issue affects versions from 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1.

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.