Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Apache CloudStack — Vulnerabilities & Security Advisories 52

All 52 CVE vulnerabilities found in Apache CloudStack, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities within the Apache CloudStack platform, categorized under the vendor Apache and the weakness types associated with its architecture. It aggregates known issues affecting this cloud computing infrastructure software, providing a centralized view of historical and recent security disclosures. The collection includes a comprehensive range of vulnerability types, such as remote code execution, privilege escalation, and cross-site scripting flaws, covering reported incidents from early releases up to the most recent updates. Users can utilize this resource to track vendor advisories and understand the evolution of security practices for this specific product. The page also allows for a deeper exploration of individual weakness classes to see how they manifest within the CloudStack environment. Additionally, it serves as a lookup tool for reviewing a product’s vulnerability history, helping security teams assess risk exposure over time. By consolidating these data points, the page facilitates better situational awareness for administrators and developers responsible for maintaining the integrity and stability of CloudStack deployments. This information is intended to support informed decision-making regarding patching priorities and configuration hardening measures without relying on third-party interpretations or speculative analysis.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak CWE-772 6.8 Medium 2026-08-21
CVE-2026-47359 Apache CloudStack: OS Command Injection due to unsanitized mount command CWE-78 - - 2026-08-21
CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates CWE-78 - - 2026-08-21
CVE-2026-50222 Apache CloudStack: Improper access control in Userdata reference APIs CWE-862 - - 2026-08-21
CVE-2026-59085 Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module CWE-918 - - 2026-08-21
CVE-2026-59655 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure CWE-200 - - 2026-08-21
CVE-2026-59657 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob CWE-312 - - 2026-08-21
CVE-2026-59780 Apache CloudStack: LDAP provider configuration disclosure CWE-200 - - 2026-08-21
CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow CWE-269 - - 2026-08-21
CVE-2026-61397 Apache CloudStack: OAuth2 Token Cross-Request Leak CWE-200 - - 2026-08-21
CVE-2026-61398 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI CWE-116 - - 2026-08-21
CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI CWE-116 - - 2026-08-21
CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection CWE-77 - - 2026-08-21
CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate CWE-918 - - 2026-08-21
CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation CWE-284 - - 2026-08-21
CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access CWE-200 - - 2026-08-21
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins CWE-862 - - 2026-08-21
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue CWE-285 - - 2026-08-21
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure CWE-284 - - 2026-08-21
CVE-2026-68745 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP CWE-347 - - 2026-08-21
CVE-2026-25199 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access CWE-200 10.0AI Critical AI 2026-05-08
CVE-2026-25077 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates CWE-94 8.8AI High AI 2026-05-08
CVE-2025-69233 Apache CloudStack: Domain/account resources limits not honored CWE-367 6.5 Medium 2026-05-08
CVE-2025-66467 Apache CloudStack: MinIO policy remains intact on bucket deletion CWE-459 8.0 High 2026-05-08
CVE-2025-66172 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to CWE-359 6.5AI Medium AI 2026-05-08
CVE-2025-66171 Apache CloudStack: Any user can create a new VM from backups they should not have access to CWE-359 6.5AI Medium AI 2026-05-08
CVE-2025-66170 Apache CloudStack: Any user can list backups that they should not have access to CWE-863 4.3AI Medium AI 2026-05-08
CVE-2025-59302 Apache CloudStack: Potential remote code execution on Javascript engine defined rules CWE-94 7.2 - 2025-11-27
CVE-2025-59454 Apache CloudStack: Lack of user permission validation leading to data leak for few APIs CWE-200 4.3 - 2025-11-27
CVE-2025-30675 Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins CWE-200 4.7 Medium 2025-06-10

All 52 known CVE vulnerabilities affecting Apache CloudStack with full Chinese analysis, references, and POCs where available.