CVE-2026-59780— Apache CloudStack: LDAP provider configuration disclosure
Quick assessment
Affected
Apache Software Foundation Apache CloudStack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
未授权访问敏感信息漏洞存在于 Apache CloudStack 的 LDAP 认证插件中，具体发生在列出 LDAP 提供商时。 任何已通过身份验证且具有访问 API 权限的用户，均可列出 LDAP 配置。默认情况下，该 API 对所有默认角色开放。 此漏洞影响 Apache CloudStack 以下版本： 4.2.0.0 至 4.20.3.0（含） 4.21.0.0 至 4.22.1.0（含） 建议用户升级至版本 4.20.3.1 或 4.22.1.1 及更高版本，以修复该问题。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.2.0.0≤ 4.20.3.0 |
affected |
4.21.0.0≤ 4.22.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59780
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CloudStack: LDAP provider configuration disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.
LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.
This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.2.0.0 ~ 4.20.3.0 | - |
|
II. Public POCs for CVE-2026-59780
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59780
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-59780 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-21 · 21 CVEs total
| CVE-2026-59654 | 6.8 MEDIUM | Apache CloudStack: DoS caused by database connections leak |
| CVE-2026-61398 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Fun | |
| CVE-2026-68745 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP | |
| CVE-2026-66797 | Apache CloudStack: Unauthorised comment creation and disclosure | |
| CVE-2026-66722 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue | |
| CVE-2026-66721 | Apache CloudStack: Authorization issue with listHostTags for domain admins | |
| CVE-2026-65613 | Apache CloudStack: Webhook Deliveries Incorrect Access | |
| CVE-2026-62440 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulatio | |
| CVE-2026-61422 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate | |
| CVE-2026-61400 | Apache CloudStack: Get and Run Diagnostics Command Injection | |
| CVE-2026-61399 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | |
| CVE-2026-61397 | Apache CloudStack: OAuth2 Token Cross-Request Leak | |
| CVE-2026-59799 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | |
| CVE-2026-59657 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob | |
| CVE-2026-59655 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | |
| CVE-2026-59085 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs | |
| CVE-2026-50112 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | |
| CVE-2026-47359 | Apache CloudStack: OS Command Injection due to unsanitized mount command | |
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials |
IV. Related Vulnerabilities
Same product: Apache CloudStack
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer -
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulner
Same vendor: Apache Software Foundation
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer
Same weakness: CWE-200
-
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-56380
AVideo feed/index.php Exposure of Channel Owner Email Addres -
CVE-2026-48050
Arc: Unauthenticated access to Go debug pprof endpoints leak -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-53497
CrossWatch: Unauthenticated /api/app-auth/status endpoint le
V. Comments for CVE-2026-59780
No comments yet