What’s Vulnerable › Products

Apache Software Foundation Apache CloudStack vulnerabilities

65 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.

Check whether your Apache Software Foundation Apache CloudStack version is affected

Latest Apache Software Foundation Apache CloudStack vulnerabilities

• CVE-2026-59654 — Apache CloudStack: DoS caused by database connections leak (CVSS 7.5)
• CVE-2026-68745 — Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP (CVSS 8.1)
• CVE-2026-66797 — Apache CloudStack: Unauthorised comment creation and disclosure (CVSS 5.4)
• CVE-2026-66722 — Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue (CVSS 7.2)
• CVE-2026-66721 — Apache CloudStack: Authorization issue with listHostTags for domain admins (CVSS 2.7)
• CVE-2026-65613 — Apache CloudStack: Webhook Deliveries Incorrect Access (CVSS 4.3)
• CVE-2026-62440 — Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation (CVSS 9.1)
• CVE-2026-61422 — Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate (CVSS 4.3)
• CVE-2026-61400 — Apache CloudStack: Get and Run Diagnostics Command Injection (CVSS 8.8)
• CVE-2026-61399 — Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI (CVSS 4.8)
• CVE-2026-61398 — Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI (CVSS 9.1)
• CVE-2026-61397 — Apache CloudStack: OAuth2 Token Cross-Request Leak (CVSS 7.5)
• CVE-2026-59799 — Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow (CVSS 8.8)
• CVE-2026-59780 — Apache CloudStack: LDAP provider configuration disclosure (CVSS 7.5)
• CVE-2026-59657 — Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob (CVSS 7.5)
• CVE-2026-59655 — Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure (CVSS 7.5)
• CVE-2026-59085 — Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module (CVSS 9.1)
• CVE-2026-50222 — Apache CloudStack: Improper access control in Userdata reference APIs (CVSS 7.5)
• CVE-2026-50112 — Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates (CVSS 8.8)
• CVE-2026-47359 — Apache CloudStack: OS Command Injection due to unsanitized mount command (CVSS 8.8)
• CVE-2026-25199 — Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access (CVSS 9.1)
• CVE-2026-25077 — Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates (CVSS 8.8)
• CVE-2025-69233 — Apache CloudStack: Domain/account resources limits not honored (CVSS 5.3)
• CVE-2025-66467 — Apache CloudStack: MinIO policy remains intact on bucket deletion (CVSS 8.1)
• CVE-2025-66172 — Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to (CVSS 8.1)