Apache CloudStack LTS Security Release: 19 CVEs Including SSRF, RCE, and Auth Bypass

Vulnerability Overview Apache CloudStack LTS security versions 4.20.3.1 and 4.22.1.1 have been released, addressing the following security issues: CVE-2026-47359: OS command injection due to unhandled mount commands CVE-2026-50112: SSRF and direct download via Metalink mirror URL templates CVE-2026-50222: Improper access control in the User Data Reference API CVE-2026-59085: Server-Side Request Forgery (SSRF) vulnerability in the webhook module CVE-2026-59655: Leakage of unauthenticated OAuth provider client secrets CVE-2026-59657: Leakage of sensitive information stored in cleartext CVE-2026-59780: LDAP provider configuration leakage CVE-2026-59799: Missing permission checks in the two-factor authentication disable process CVE-2026-61397: OAuth2 token leakage across requests CVE-2026-61398: Cross-Site Scripting (XSS) vulnerability in the instance reset password feature CVE-2026-61399: Cross-Site Scripting (XSS) vulnerability in the user lock feature CVE-2026-61400: Command injection when retrieving and executing diagnostic commands CVE-2026-61422: Authentication pre-validation SSRF during template registration CVE-2026-62440: Improper access control in Kubernetes (K8s) cluster operations CVE-2026-65613: Improper access in webhook delivery CVE-2026-66721: Authorization issues with hostTags lists for domain administrators CVE-2026-66722: Authorization issues with hostTags lists for domain administrators CVE-2026-66797: Authorization issues with hostTags lists for domain administrators CVE-2026-68745: Authorization issues with hostTags lists for domain administrators Affected Versions CVE-2026-47359: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-50112: Apache CloudStack 4.14.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-50222: Apache CloudStack 4.18.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-59085: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-59655: Apache CloudStack 4.19.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-59657: Apache CloudStack 4.0.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-59780: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-59799: Apache CloudStack 4.18.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-61397: Apache CloudStack 4.19.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-61398: Apache CloudStack 4.15.1.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-61399: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-61400: Apache CloudStack 4.14.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-61422: Apache CloudStack 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-62440: Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-65613: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-66721: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-66722: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-66797: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 CVE-2026-68745: Apache CloudStack 4.20.0.0 to 4.20.3.0, Apache CloudStack 4.21.0.0 to 4.22.1.0 Remediation Users are advised to upgrade to version 4.20.3.1, 4.22.1.1, or later to resolve these issues. POC Code or Exploit Code No specific POC code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Apache CloudStack LTS Security Release: 19 CVEs Including SSRF, RCE, and Auth Bypass