CVE-2026-61422
Received Received - Intake

Authenticated SSRF in Apache CloudStack Template ISO Registration

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Apache Software Foundation

Description
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-61422
EUVD
EUVD-2026-63836

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache cloudstack From 4.21.0.0 (inc) to 4.22.1.0 (inc)
apache cloudstack 4.20.3.1
apache cloudstack 4.22.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack performs an HTTP HEAD/GET request to check file size before validating the URL, which could allow an attacker to probe internal systems.

Detection Guidance

This vulnerability involves an SSRF issue during template or ISO registration in Apache CloudStack. Detection requires checking CloudStack logs for HTTP HEAD/GET requests made during template/ISO registration before URL validation. Monitor network traffic from the management server to external hosts during these operations.

Impact Analysis

An attacker with valid credentials could exploit this to send requests to internal systems, potentially accessing sensitive data or services. However, the actual download is still validated, limiting direct impact.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it involves an authenticated pre-validation SSRF issue in template and ISO registration. The vulnerability occurs during URL validation checks and does not expose sensitive data or violate data protection requirements.

Mitigation Strategies

Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later to fix the issue. If immediate upgrade is not possible, restrict network access to the management server to limit exposure until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart