Threat database

CVE-2026-61398 is a critical vulnerability in Apache CloudStack affecting versions from 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It involves improper encoding or escaping of output in the UI during the Instance Reset Password functionality. This flaw can lead to high impact on confidentiality and integrity. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-61399 is an improper encoding or escaping of output vulnerability in the Apache CloudStack UI related to the Lock User functionality. It affects versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.8.

CVE-2026-61400 is a command injection vulnerability in Apache CloudStack affecting the run and get diagnostics functionality for system VMs and virtual routers. Authenticated users with admin permissions on the getDiagnosticsData or runDiagnostics APIs can execute arbitrary commands as root or diagnostics-process user. This allows full compromise of affected instances and potential lateral movement within the CloudStack infrastructure. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.

CVE-2026-61422 is an authenticated server-side request forgery (SSRF) vulnerability in Apache CloudStack affecting template and ISO registration. The vulnerability occurs because CloudStack makes a live HTTP HEAD/GET request to determine file size before validating the URL. However, URL validation is still performed before the actual download, reducing the risk of malicious template or ISO registration. The issue affects versions 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.

CVE-2026-62440 is an improper access control vulnerability in the Kubernetes Service (CKS) plugin of Apache CloudStack. It allows unauthorized cross-tenant manipulation of Kubernetes clusters during node addition and removal. The issue affects Apache CloudStack versions from 4.21.0.0 through 4.22.1.0. Upgrading to version 4.22.1.1 or later resolves the vulnerability.

CVE-2026-65613 is a vulnerability in Apache CloudStack's Webhook module that allows exposure of sensitive information to unauthorized actors during listing and deleting deliveries. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-66721 is a missing authorization vulnerability in Apache CloudStack affecting the listHostTags API. Domain admins can call this API and receive host tags for all hosts in the environment, not just those scoped to their domain. This issue affects Apache CloudStack versions from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the issue.

CVE-2026-66722 is an improper authorization vulnerability in Apache CloudStack affecting versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It allows a Domain Admin to perform create, update, delete, and list operations on project roles and permissions across any domain, not limited to their own. This occurs because the authorization check only verifies the caller's Domain Admin status without confirming domain ownership of the target project. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-66797 is an improper access control vulnerability in Apache CloudStack's annotation functionality. It allows any authenticated user to create and view annotations on entities they do not own by bypassing ownership checks. The flaw affects versions from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

Apache CloudStack versions 4.20.3.0 and 4.22.1.0 contain a vulnerability in SAML authentication where improper verification of cryptographic signatures allows a malicious actor to forge SAML responses. This can enable unauthorized login if the attacker spoofs the IdP IP address or registers a URL with the management server. Fixed versions 4.20.3.1 and 4.22.1.1 address this issue.

CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong that allows any authenticated user, without requiring admin privileges, to make the InLong Manager server send outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This affects Apache InLong versions from 2.0.0 up to but not including 2.4.0. The issue is addressed in version 2.4.0 and can also be mitigated by applying the referenced patch from the Apache InLong GitHub repository.

CVE-2026-63043 is a Relative Path Traversal vulnerability in Apache InLong that allows arbitrary file read from the Agent host filesystem. It affects versions from 2.0.0 up to but not including 2.4.0. The vulnerability has a high severity with a CVSS score of 7.5. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.

CVE-2026-63042 is a vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. It allows any authenticated user with access to the manager interface to create, modify, and delete Data Node definitions due to files or directories being accessible to external parties. This issue is addressed in Apache InLong version 2.4.0.

CVE-2026-63040 is a vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. The issue arises because the StreamSource component does not perform authorization checks, allowing any authenticated user to logically delete all stream sources. This vulnerability has a high severity score of 8.1 and impacts integrity and availability without affecting confidentiality. Users are advised to upgrade to version 2.4.0 or apply the specific patch referenced in the vendor's pull request to remediate the issue.