Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Apache CloudStack — Vulnerabilities & Security Advisories 52

All 52 CVE vulnerabilities found in Apache CloudStack, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerabilities associated with Apache CloudStack, a virtualization and cloud management platform. It collects publicly disclosed security flaws and their remediation details across multiple Common Weakness Enumerations (CWE) categories. Here, you can track the vendor's advisory history, analyze the prevalence of specific weakness classes, or review the full vulnerability timeline for this product. The dataset covers advisories published from 2014 through the present, offering a comprehensive view of how the software has evolved in terms of security posture. Use this resource to identify patterns in reported issues, assess risk exposure for deployments of Apache CloudStack, and understand the relationship between specific code defects and their real-world impact. The entries link to original sources, allowing direct verification of each record.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak CWE-772 6.8 Medium 2026-08-21
CVE-2026-47359 Apache CloudStack: OS Command Injection due to unsanitized mount command CWE-78 - - 2026-08-21
CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates CWE-78 - - 2026-08-21
CVE-2026-50222 Apache CloudStack: Improper access control in Userdata reference APIs CWE-862 - - 2026-08-21
CVE-2026-59085 Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module CWE-918 - - 2026-08-21
CVE-2026-59655 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure CWE-200 - - 2026-08-21
CVE-2026-59657 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob CWE-312 - - 2026-08-21
CVE-2026-59780 Apache CloudStack: LDAP provider configuration disclosure CWE-200 - - 2026-08-21
CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow CWE-269 - - 2026-08-21
CVE-2026-61397 Apache CloudStack: OAuth2 Token Cross-Request Leak CWE-200 - - 2026-08-21
CVE-2026-61398 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI CWE-116 - - 2026-08-21
CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI CWE-116 - - 2026-08-21
CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection CWE-77 - - 2026-08-21
CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate CWE-918 - - 2026-08-21
CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation CWE-284 - - 2026-08-21
CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access CWE-200 - - 2026-08-21
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins CWE-862 - - 2026-08-21
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue CWE-285 - - 2026-08-21
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure CWE-284 - - 2026-08-21
CVE-2026-68745 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP CWE-347 - - 2026-08-21
CVE-2026-25199 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access CWE-200 10.0AI Critical AI 2026-05-08
CVE-2026-25077 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates CWE-94 8.8AI High AI 2026-05-08
CVE-2025-69233 Apache CloudStack: Domain/account resources limits not honored CWE-367 6.5 Medium 2026-05-08
CVE-2025-66467 Apache CloudStack: MinIO policy remains intact on bucket deletion CWE-459 8.0 High 2026-05-08
CVE-2025-66172 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to CWE-359 6.5AI Medium AI 2026-05-08
CVE-2025-66171 Apache CloudStack: Any user can create a new VM from backups they should not have access to CWE-359 6.5AI Medium AI 2026-05-08
CVE-2025-66170 Apache CloudStack: Any user can list backups that they should not have access to CWE-863 4.3AI Medium AI 2026-05-08
CVE-2025-59302 Apache CloudStack: Potential remote code execution on Javascript engine defined rules CWE-94 7.2 - 2025-11-27
CVE-2025-59454 Apache CloudStack: Lack of user permission validation leading to data leak for few APIs CWE-200 4.3 - 2025-11-27
CVE-2025-30675 Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins CWE-200 4.7 Medium 2025-06-10

All 52 known CVE vulnerabilities affecting Apache CloudStack with full Chinese analysis, references, and POCs where available.