Advisories · Technology

Apache Software Foundation Apache CloudStack.

Every CVE that names Apache Software Foundation Apache CloudStack among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-59654 CVE record

CVSS 6.8 Medium

Apache CloudStack: DoS caused by database connections leak
- Apache Software Foundation Apache CloudStack
- Denial of service
Not analysed yet 21 Aug 2026
CVE-2026-47359 CVE record

CVSS 8.8 High

Apache CloudStack: OS Command Injection due to unsanitized mount command
- Apache Software Foundation Apache CloudStack
- Command injection
Not analysed yet 21 Aug 2026
CVE-2026-50112 CVE record

CVSS 8.8 High

Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
- Apache Software Foundation Apache CloudStack
- Command injection
- Server-side request forgery (SSRF)
Not analysed yet 21 Aug 2026
CVE-2026-50222 CVE record

CVSS 7.5 High

Apache CloudStack: Improper access control in Userdata reference APIs
- Apache Software Foundation Apache CloudStack
- Information disclosure
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-59085 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
- Apache Software Foundation Apache CloudStack
- Server-side request forgery (SSRF)
Not analysed yet 21 Aug 2026
CVE-2026-59655 CVE record

CVSS 7.5 High

Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-59657 CVE record

CVSS 7.5 High

Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-59780 CVE record

CVSS 7.5 High

Apache CloudStack: LDAP provider configuration disclosure
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-59799 CVE record

CVSS 8.8 High

Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
- Apache Software Foundation Apache CloudStack
- Privilege escalation
Not analysed yet 21 Aug 2026
CVE-2026-61397 CVE record

CVSS 7.5 High

Apache CloudStack: OAuth2 Token Cross-Request Leak
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-61398 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
- Apache Software Foundation Apache CloudStack
- CWE-116
Not analysed yet 21 Aug 2026
CVE-2026-61399 CVE record

CVSS 4.8 Medium

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
- Apache Software Foundation Apache CloudStack
- CWE-116
Not analysed yet 21 Aug 2026
CVE-2026-61400 CVE record

CVSS 8.8 High

Apache CloudStack: Get and Run Diagnostics Command Injection
- Apache Software Foundation Apache CloudStack
- Command injection
Not analysed yet 21 Aug 2026
CVE-2026-61422 CVE record

CVSS 4.3 Medium

Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
- Apache Software Foundation Apache CloudStack
- Server-side request forgery (SSRF)
Not analysed yet 21 Aug 2026
CVE-2026-62440 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
- Apache Software Foundation Apache CloudStack
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-65613 CVE record

CVSS 4.3 Medium

Apache CloudStack: Webhook Deliveries Incorrect Access
- Apache Software Foundation Apache CloudStack
- Information disclosure
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-66721 CVE record

CVSS 2.7 Low

Apache CloudStack: Authorization issue with listHostTags for domain admins
- Apache Software Foundation Apache CloudStack
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-66722 CVE record

CVSS 7.2 High

Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
- Apache Software Foundation Apache CloudStack
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-66797 CVE record

CVSS 5.4 Medium

Apache CloudStack: Unauthorised comment creation and disclosure
- Apache Software Foundation Apache CloudStack
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-68745 CVE record

CVSS 8.1 High

Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP
- Apache Software Foundation Apache CloudStack
- Weak cryptography or TLS
Not analysed yet 21 Aug 2026
CVE-2026-25199 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 8 May 2026
CVE-2026-25077 CVE record

CVSS 8.8 High

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates
- Apache Software Foundation Apache CloudStack
- Code injection
Not analysed yet 8 May 2026
CVE-2025-69233 CVE record

CVSS 6.5 Medium

Apache CloudStack: Domain/account resources limits not honored
- Apache Software Foundation Apache CloudStack
- Race condition
- Denial of service
Not analysed yet 8 May 2026
CVE-2025-66467 CVE record

CVSS 8.0 High

Apache CloudStack: MinIO policy remains intact on bucket deletion
- Apache Software Foundation Apache CloudStack
- CWE-459
Not analysed yet 8 May 2026
CVE-2025-66172 CVE record

CVSS 8.1 High

Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 8 May 2026
CVE-2025-66171 CVE record

CVSS 6.5 Medium

Apache CloudStack: Any user can create a new VM from backups they should not have access to
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 8 May 2026
CVE-2025-66170 CVE record

CVSS 6.5 Medium

Apache CloudStack: Any user can list backups that they should not have access to
- Apache Software Foundation Apache CloudStack
- Broken access control
Not analysed yet 8 May 2026
CVE-2025-59302 CVE record

CVSS 4.7 Medium

Apache CloudStack: Potential remote code execution on Javascript engine defined rules
- Apache Software Foundation Apache CloudStack
- Code injection
Not analysed yet 27 Nov 2025
CVE-2025-59454 CVE record

CVSS 4.3 Medium

Apache CloudStack: Lack of user permission validation leading to data leak for few APIs
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 27 Nov 2025
CVE-2025-30675 CVE record

CVSS 4.7 Medium

Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 10 Jun 2025
CVE-2025-22829 CVE record

CVSS 2.3 Low

Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
- Apache Software Foundation Apache CloudStack
- Privilege escalation
Not analysed yet 10 Jun 2025
CVE-2025-26521 CVE record

CVSS 8.1 High

Apache CloudStack: CKS cluster in project exposes user API keys
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 10 Jun 2025
CVE-2025-47849 CVE record

CVSS 8.8 High

Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain
- Apache Software Foundation Apache CloudStack
- Privilege escalation
Not analysed yet 10 Jun 2025
CVE-2025-47713 CVE record

CVSS 8.8 High

Apache CloudStack: Domain Admin can reset Admin password in Root Domain
- Apache Software Foundation Apache CloudStack
- Privilege escalation
Not analysed yet 10 Jun 2025
CVE-2025-22828 CVE record

CVSS 4.3 Medium

Apache CloudStack: Unauthorised access to annotations
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 13 Jan 2025
CVE-2024-50386 CVE record

CVSS 8.5 High

Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure
- Apache Software Foundation Apache CloudStack
- CWE-20
Not analysed yet 12 Nov 2024
CVE-2024-45219 CVE record

CVSS 8.5 High

Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure
- Apache Software Foundation Apache CloudStack
- CWE-20
- CWE-116
Not analysed yet 16 Oct 2024
CVE-2024-45462 CVE record

CVSS 6.3 Medium

Apache CloudStack: Incomplete session invalidation on web interface logout
- Apache Software Foundation Apache CloudStack
- Authentication bypass
Not analysed yet 16 Oct 2024
CVE-2024-45693 CVE record

CVSS 8.0 High

Apache CloudStack: Request origin validation bypass makes account takeover possible
- Apache Software Foundation Apache CloudStack
- Cross-site request forgery (CSRF)
Not analysed yet 16 Oct 2024
CVE-2024-42062 CVE record

CVSS 7.2 High

Apache CloudStack: User Key Exposure to Domain Admins
- Apache Software Foundation Apache CloudStack
- Broken access control
Not analysed yet 7 Aug 2024
CVE-2024-42222 CVE record

CVSS 4.3 Medium

Apache CloudStack: Unauthorised Network List Access
- Apache Software Foundation Apache CloudStack
- Information disclosure
Not analysed yet 7 Aug 2024
CVE-2024-41107 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

Apache CloudStack: SAML Signature Exclusion
- Apache Software Foundation Apache CloudStack
- Authentication bypass
Not analysed yet 19 Jul 2024
CVE-2024-38346 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- Apache Software Foundation Apache CloudStack
- Code injection
Not analysed yet 5 Jul 2024
CVE-2024-39864 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache CloudStack: Integration API service uses dynamic port when disabled
- Apache Software Foundation Apache CloudStack
- Code injection
- CWE-665
Not analysed yet 5 Jul 2024
CVE-2024-29008 CVE record

CVSS 6.4 Medium

Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance
- Apache Software Foundation Apache CloudStack
- CWE-20
Not analysed yet 4 Apr 2024
CVE-2024-29007 CVE record

CVSS 7.3 High

Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences
- Apache Software Foundation Apache CloudStack
- Server-side request forgery (SSRF)
Not analysed yet 4 Apr 2024
CVE-2024-29006 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache CloudStack: x-forwarded-for HTTP header parsed by default
- Apache Software Foundation Apache CloudStack
- Authentication bypass
Not analysed yet 4 Apr 2024
CVE-2022-35741 CVE record

Apache CloudStack SAML Single Sign-On XXE
- Apache Software Foundation Apache CloudStack
Not analysed yet 18 Jul 2022
CVE-2022-26779 CVE record

Apache Cloudstack insecure random number generation affects project email invitation
- Apache Software Foundation Apache CloudStack
Not analysed yet 15 Mar 2022
CVE-2016-6813 CVE record

Apache Software Foundation Apache CloudStack: Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user…
- Apache Software Foundation Apache CloudStack
Not analysed yet 6 Feb 2018
CVE-2013-4317 CVE record

Apache Software Foundation Apache CloudStack: In Apache CloudStack 4.1.0 and 4.1.1…
- Apache Software Foundation Apache CloudStack
Not analysed yet 6 Feb 2018