Threat Intelligence Database

Apache CloudStack contains an OS Command Injection vulnerability in its NAS backup provider plugin. The addBackupRepository and updateBackupRepository APIs accept unsanitized command options, allowing a malicious operator to inject arbitrary commands executed on the KVM hypervisor host during backup restore operations. This affects versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

An improper access control vulnerability exists in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing unauthorized cross-tenant manipulation of Kubernetes clusters during node addition and removal. This affects Apache CloudStack versions from 4.21.0.0 through 4.22.1.0. The issue is resolved in version 4.22.1.1 and later.

An improper encoding or escaping of output vulnerability exists in Apache CloudStack's UI related to the Lock User functionality. This vulnerability affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue has been fixed in versions 4.20.3.1 and 4.22.1.1 or later. Users are advised to upgrade to these fixed versions to remediate the vulnerability.

A Server-Side Request Forgery (SSRF) vulnerability exists in the webhook module of Apache CloudStack. This vulnerability can be exploited via webhook delivery requests. It affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

Apache CloudStack versions 4.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 contain a vulnerability where sensitive information is stored in cleartext within the AsyncJob database storage. This issue is identified as CVE-2026-59657 and relates to CWE-312 (Cleartext Storage of Sensitive Information). Upgrading to versions 4.20.3.1 or 4.22.1.1 or later addresses this vulnerability.

An exposure of sensitive information vulnerability exists in Apache CloudStack's OAuth authentication plugin when listing OAuth providers. This affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue allows unauthorized actors to access sensitive data. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

Apache CloudStack versions from 4.2.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 have a vulnerability in the LDAP authentication plugin that allows any authenticated user with access to the listLdapConfigurations API to list LDAP configurations, exposing sensitive information. By default, this API is accessible to all default roles. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

An improper encoding or escaping of output vulnerability exists in Apache CloudStack's UI during the Instance Reset Password functionality. This affects versions from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 contain a command injection vulnerability in the run and get diagnostics functionality for system VMs and virtual routers. Authenticated users with admin permissions to invoke getDiagnosticsData or runDiagnostics APIs can execute arbitrary commands as root or diagnostics-process user on affected instances. This can lead to full compromise of the instance and potential lateral movement within the CloudStack infrastructure. The vulnerability is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

A vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows exposure of sensitive information to unauthorized actors. This affects Apache CloudStack versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1.