CVE-2026-61422— Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
Quick assessment
Affected
Apache Software Foundation Apache CloudStack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache CloudStack 的模板和 ISO 注册功能中存在认证前的预验证 SSRF（服务器端请求伪造）漏洞。 在注册模板或 ISO 时，CloudStack 会发起实时的 HTTP HEAD/GET 请求以获取文件大小，用于检查二级存储的使用限制。该请求发生在 URL 验证之前。不过，由于实际下载操作由二级存储虚拟机执行，且在下载前仍会进行 URL 验证，因此该行为并不会导致恶意模板或 ISO 的注册风险。 此问题影响以下版本的 Apache CloudStack：4.20.3.0，以及从 4.21.0.
Possible ATT&CK Techniques 1 AI
T1187 · Forced AuthenticationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.20.3.0 |
affected |
4.21.0.0≤ 4.22.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61422
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
Source: CVE Program / CVE List V5
Vulnerability Description
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.
When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.20.3.0 | - |
|
II. Public POCs for CVE-2026-61422
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61422
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-61422 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-21 · 21 CVEs total
| CVE-2026-59654 | 6.8 MEDIUM | Apache CloudStack: DoS caused by database connections leak |
| CVE-2026-61397 | Apache CloudStack: OAuth2 Token Cross-Request Leak | |
| CVE-2026-68745 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP | |
| CVE-2026-66797 | Apache CloudStack: Unauthorised comment creation and disclosure | |
| CVE-2026-66722 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue | |
| CVE-2026-66721 | Apache CloudStack: Authorization issue with listHostTags for domain admins | |
| CVE-2026-65613 | Apache CloudStack: Webhook Deliveries Incorrect Access | |
| CVE-2026-62440 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulatio | |
| CVE-2026-61400 | Apache CloudStack: Get and Run Diagnostics Command Injection | |
| CVE-2026-61399 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | |
| CVE-2026-61398 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Fun | |
| CVE-2026-59799 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | |
| CVE-2026-59780 | Apache CloudStack: LDAP provider configuration disclosure | |
| CVE-2026-59657 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob | |
| CVE-2026-59655 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | |
| CVE-2026-59085 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs | |
| CVE-2026-50112 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | |
| CVE-2026-47359 | Apache CloudStack: OS Command Injection due to unsanitized mount command | |
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials |
IV. Related Vulnerabilities
Same product: Apache CloudStack
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer -
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulner
Same vendor: Apache Software Foundation
-
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authenticat -
CVE-2026-66907
Apache Camel: Camel-Google-Storage: the consumer appended th -
CVE-2026-66906
Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFi -
CVE-2026-60093
Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFi -
CVE-2026-59230
Apache Camel: Camel-Mail: the MimeMultipart data format copi
Same weakness: CWE-918
-
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage -
CVE-2026-78385
RansomLook Analysis PDF Generation Allows Server-Side Reques -
CVE-2026-78277
WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Reque -
CVE-2026-78269
WordPress Shared Files plugin <= 1.7.69 - Server Side Reques -
CVE-2026-10582
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via
V. Comments for CVE-2026-61422
No comments yet