CVE-2026-68745

EUVD-2026-63830

21.08.2026, 09:16

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.

Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	UNKNOWN				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 0.09%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	cloudstack	4.5.2 ≤ 𝑥 ≤ 4.20.3.0	CNA
apache	cloudstack	4.21.0.0 ≤ 𝑥 ≤ 4.22.1.0	CNA

Common Weakness Enumeration

CWE-347 - Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.

Vulnerability Media Exposure

[GERMAN] Apache CloudStack: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
Published: 2026-08-20T22:00:00+00:00

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc