EUVD-2026-63845
GHSA-5c78-m4xc-xx66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CloudStack management API
-
DeliveryRegister webhook with internal target URL
-
ExploitTrigger event to fire delivery
-
ExecutionManagement server issues SSRF request
-
PersistReach internal service or metadata endpoint
-
ImpactExfiltrate data or pivot internally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target CloudStack deployment to have the webhook module in use and reachable, and the attacker must be able to influence a webhook delivery request/target URL. The CVSS vector claims PR:N (no privileges) and no user interaction, which would mean network-reachable exploitation, but webhook creation/configuration in CloudStack is an account-scoped operation - so in practice an authenticated CloudStack account is the likely prerequisite; this PR:N vs. operator-configuration discrepancy should be verified against the Apache advisory. Limiting factors: only versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0 are affected, the webhook feature must be enabled/usable, and exploitation value depends on the management server having network paths to sensitive internal services. |
| Impact | Signals conflict on real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) rates this 9.1 and marks it unauthenticated, yet the vulnerability lives in the webhook module, and configuring webhook delivery in CloudStack normally requires an authenticated account - so PR:N is questionable and should be verified with the Apache advisory; if authentication is in fact required, effective risk drops toward that of an authenticated tenant/operator abuse case. Countering the high CVSS, EPSS is very low (0.14%, 4th percentile), there is no KEV listing, and no public PoC, so there is no evidence of widespread or automated exploitation. Net assessment: a genuinely serious SSRF worth prioritized patching in exposed CloudStack deployments (especially multi-tenant clouds where internal metadata/service pivoting is high-value), but currently a patch-in-normal-cycle item rather than an emergency, pending confirmation of the true authentication prerequisite. |
| Exploit ScenarioDerived | An attacker with the ability to configure a webhook points its delivery target at an internal-only address (for example the cloud metadata service or an unauthenticated internal admin API), then triggers an event that causes the CloudStack management server to send the request from its trusted network position, returning or acting on internal data the attacker could not otherwise reach. Given AV:N/AC:L, the request is low-complexity and network-delivered; no public PoC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issuing arbitrary HTTP requests via webhook delivery, reaching internal-only services and cloud metadata endpoints that are otherwise unreachable from outside. It affects Apache CloudStack 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, carries a CVSS 9.1 (high confidentiality and integrity impact), and has no public exploit identified at time of analysis. EPSS is low at 0.14% (4th percentile) and it is not on CISA KEV, indicating no observed active exploitation yet.
Earlier versions of this analysis (1)
Server-Side Request Forgery in Apache CloudStack's webhook delivery module allows authenticated attackers to coerce the management server into issuing arbitrary HTTP requests to internal network destinations, including cloud metadata services and administrative interfaces. Affected deployments span the 4.20.x and 4.21.x/4.22.x release lines across a wide installation base of enterprise and managed-cloud environments. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV, though SSRF in IaaS management platforms carries elevated risk due to typical proximity to internal credentials and hypervisor APIs.
RemediationAI
Vendor-released patch: upgrade to Apache CloudStack 4.20.3.1 (for the 4.20.x branch) or 4.22.1.1 (for the 4.21.x/4.22.x branch) or later, per the Apache advisory at https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc. If immediate upgrade is not possible, restrict or disable the webhook feature so untrusted users cannot register or trigger delivery URLs, and place the management server behind strict egress filtering that blocks outbound connections from the management server to internal ranges (RFC1918), loopback, link-local 169.254.0.0/16, and cloud metadata endpoints (e.g. 169.254.169.254) - accepting that egress lockdown may break other legitimate management-server integrations and that disabling webhooks removes event-notification functionality. Limit webhook configuration privileges to trusted administrators only as an interim control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CloudStack is an open-source IaaS orchestration platform (compute, network, and storage management for cloud environments). The flaw is a classic CWE-918 Server-Side Request Forgery in the webhook subsystem, which is designed to POST event notifications to operator-defined callback URLs. Because the delivery mechanism fetches or connects to attacker-influenceable destinations without adequately validating or restricting the target, the CloudStack management server can be induced to send requests to arbitrary internal hosts, ports, and URI schemes. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_cloudstack:*, i.e. the core CloudStack management server rather than a plugin or agent.
Know when Apache Cloudstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Webhook configuration requires an authenticated account so PR:L not PR:N; SSRF primarily exposes internal data (C:H) with limited request-forging integrity impact (I:L) and no availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Executive ViewAI
A critical Server-Side Request Forgery vulnerability in Apache CloudStack's webhook module (CVE-2026-59085, CVSS 9.1) allows attackers to coerce the management server into requesting internal resources and cloud metadata endpoints, exposing sensitive credentials and enabling lateral movement within infrastructure. Organizations running CloudStack 4.20.0-4.20.3 or 4.21.0-4.22.1 face high risk of data exfiltration and cloud account compromise, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Implement network-layer controls: restrict CloudStack management server egress via firewall to explicitly whitelisted external destinations only; block all outbound access to internal services and cloud metadata endpoints; disable webhook module if not operationally critical; segment CloudStack infrastructure from other systems; deploy IDS signatures for abnormal HTTP requests from CloudStack; enable detailed logging and alerting on all webhook activity and management server network connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Unauthorized cross-tenant access in Apache CloudStack 4.21.0 through 4.22.0 allows remote unauthenticated attackers to g
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
Remote code execution in Apache CloudStack allows authenticated account users to execute arbitrary code on KVM hyperviso
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Apache CloudStack deployments that use MinIO-backed object storage fail to revoke the MinIO policy associated with a buc
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows u
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to an
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating o
Exploit-DB