CVE-2026-47359 is an OS command injection vulnerability in Apache CloudStack's NAS backup provider plugin. It affects the addBackupRepository and updateBackupRepository APIs, which accept unsanitized command options. A malicious operator account can exploit this to execute arbitrary commands on the KVM hypervisor host during backup restore operations. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.
CVE-2026-50112 is a high-severity OS command injection vulnerability in Apache CloudStack affecting versions from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. An authenticated tenant can exploit this by registering a VM template with a malicious metalink file, leading to remote code execution as root on the KVM hypervisor host. The issue arises because inner URLs in metalink XML files are not properly validated against allowed schemes. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-50222 is a high-severity vulnerability in Apache CloudStack affecting userdata-related APIs. Several APIs lack proper authorization checks, allowing unauthorized access to userdata resources across tenants. Affected versions include 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue also affects the deleteCniConfiguration API introduced in 4.21.0.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59085 is a critical Server-Side Request Forgery (SSRF) vulnerability in the webhook module of Apache CloudStack. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows unauthenticated attackers to send crafted webhook delivery requests that could lead to unauthorized information disclosure and impact confidentiality and integrity. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59655 is a vulnerability in Apache CloudStack's OAuth authentication plugin that allows exposure of sensitive information to unauthorized actors when listing OAuth providers. This affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59657 is a high-severity vulnerability in Apache CloudStack that involves cleartext storage of sensitive information in the AsyncJob database storage. This affects versions from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows sensitive data to be stored without encryption, potentially exposing it to unauthorized access. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59780 is a high-severity vulnerability in Apache CloudStack's LDAP authentication plugin that allows exposure of sensitive information to unauthorized actors. The issue arises because any authenticated user with access to the listLdapConfigurations API can list LDAP configurations, and this API is by default accessible to all default roles. This affects Apache CloudStack versions from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59799 is an improper privilege management vulnerability in Apache CloudStack's two-factor authentication plugin. It allows bypassing the two-factor authentication disable flow. The issue affects Apache CloudStack versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.
CVE-2026-61397 is a high severity vulnerability in Apache CloudStack affecting the OAuth2 authentication plugin and Google OAuth integration. It allows exposure of sensitive information to unauthorized actors. The issue affects versions from 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1.
CVE-2026-61398 is a critical vulnerability in Apache CloudStack affecting versions from 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It involves improper encoding or escaping of output in the UI during the Instance Reset Password functionality. This flaw can lead to high impact on confidentiality and integrity. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-61399 is an improper encoding or escaping of output vulnerability in the Apache CloudStack UI related to the Lock User functionality. It affects versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.8.
CVE-2026-61400 is a command injection vulnerability in Apache CloudStack affecting the run and get diagnostics functionality for system VMs and virtual routers. Authenticated users with admin permissions on the getDiagnosticsData or runDiagnostics APIs can execute arbitrary commands as root or diagnostics-process user. This allows full compromise of affected instances and potential lateral movement within the CloudStack infrastructure. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.
CVE-2026-61422 is an authenticated server-side request forgery (SSRF) vulnerability in Apache CloudStack affecting template and ISO registration. The vulnerability occurs because CloudStack makes a live HTTP HEAD/GET request to determine file size before validating the URL. However, URL validation is still performed before the actual download, reducing the risk of malicious template or ISO registration. The issue affects versions 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.
CVE-2026-62440 is an improper access control vulnerability in the Kubernetes Service (CKS) plugin of Apache CloudStack. It allows unauthorized cross-tenant manipulation of Kubernetes clusters during node addition and removal. The issue affects Apache CloudStack versions from 4.21.0.0 through 4.22.1.0. Upgrading to version 4.22.1.1 or later resolves the vulnerability.
CVE-2026-65613 is a vulnerability in Apache CloudStack's Webhook module that allows exposure of sensitive information to unauthorized actors during listing and deleting deliveries. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-66721 is a missing authorization vulnerability in Apache CloudStack affecting the listHostTags API. Domain admins can call this API and receive host tags for all hosts in the environment, not just those scoped to their domain. This issue affects Apache CloudStack versions from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the issue.
CVE-2026-66722 is an improper authorization vulnerability in Apache CloudStack affecting versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It allows a Domain Admin to perform create, update, delete, and list operations on project roles and permissions across any domain, not limited to their own. This occurs because the authorization check only verifies the caller's Domain Admin status without confirming domain ownership of the target project. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-66797 is an improper access control vulnerability in Apache CloudStack's annotation functionality. It allows any authenticated user to create and view annotations on entities they do not own by bypassing ownership checks. The flaw affects versions from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
Apache CloudStack versions 4.20.3.0 and 4.22.1.0 contain a vulnerability in SAML authentication where improper verification of cryptographic signatures allows a malicious actor to forge SAML responses. This can enable unauthorized login if the attacker spoofs the IdP IP address or registers a URL with the management server. Fixed versions 4.20.3.1 and 4.22.1.1 address this issue.