What is the CVSS score of CVE-2026-59655?

CVE-2026-59655 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-59655?

Within 24 hours, identify all Apache CloudStack instances running versions 4.19.0.0-4.20.3.0 or 4.21.0.0-4.22.1.0 and verify which have OAuth authentication enabled. Within 7 days, implement firewall or network access controls to restrict queries to the OAuth provider listing endpoint to authorized internal users and systems only; simultaneously evaluate upgrading to unaffected versions (4.18.x or earlier, or 4.23.0 or later if available). Within 30 days, complete the upgrade to an unaffected version or implement robust network segmentation to isolate CloudStack management interfaces from untrusted network access.

Apache CloudStack CVE-2026-59655

EUVD-2026-63844 HIGH

Information Exposure (CWE-200)

2026-08-21 apache

GHSA-73gx-q9q8-7w92

Apache Information Disclosure Apache Cloudstack Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify exposed CloudStack management API port
Delivery

Request OAuth provider listing endpoint unauthenticated
Exploit

Receive OAuth client secrets in response
Execution

Use harvested credentials to impersonate CloudStack application
Impact

Access or pivot through connected identity provider

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the Apache CloudStack OAuth authentication plugin is enabled and at least one external OAuth provider (e.g., Google, GitHub, or a corporate IdP) has been configured. The vulnerable endpoint - the OAuth provider listing API - must be network-reachable by the attacker; the default CloudStack management API port (8080 or 8443) must be accessible. No authentication, user interaction, or special network position is required once these conditions are met, per the CVSS vector PR:N/UI:N/AV:N. Environments that have not configured the OAuth plugin, or that restrict management API access to internal networks, are not directly exposed. CloudStack deployments using only LDAP, SAML, or local authentication are unaffected.
Impact	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N paints a severe picture: trivially exploitable over the network with no authentication, yielding high confidentiality impact. However, EPSS at 0.17% (7th percentile) sharply contradicts that framing - exploitation probability is exceptionally low at time of analysis. No KEV listing and no reported POC further reduce operational urgency. The key moderating factor is deployment-conditional: the vulnerable code path is only reachable when the OAuth plugin is actively configured with at least one provider. Organizations running CloudStack purely with LDAP, SAML, or local authentication are not exposed. This is a genuine high-severity issue for CloudStack environments using OAuth federation, but the low EPSS and absence of exploit evidence suggest prioritizing patching over emergency response. The 7.5 CVSS is accurate for vulnerable configurations; real-world population at risk is narrower than the score implies.
Exploit ScenarioDerived	An unauthenticated external attacker identifies a CloudStack management API endpoint by scanning for the default ports (8080/8443) and sends a crafted API request to enumerate OAuth providers. The vulnerable plugin responds with OAuth client secrets or tokens for the configured identity provider, which the attacker then uses to forge OAuth authorization requests, impersonate the CloudStack application, or harvest credentials from integrated SSO systems. No authentication or prior access to the CloudStack environment is required, and no public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Aug 25, 2026

Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authentication plugin when the OAuth provider listing endpoint is queried. Affected versions span two release branches: 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. Despite a CVSS score of 7.5 reflecting unauthenticated network access and high confidentiality impact, EPSS sits at just 0.17% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis, suggesting limited active exploitation to date.

Earlier versions of this analysis (1)

v1 Aug 21, 2026 - 09:13

OAuth provider listing in Apache CloudStack leaks sensitive configuration information to unauthorized actors across two distinct version ranges spanning the 4.19.x through 4.22.x release lines. The OAuth authentication plugin, when handling requests to enumerate available OAuth providers, exposes data that should be restricted - likely including OAuth client credentials or secrets embedded in provider configurations. No public exploit or active exploitation has been identified at time of analysis; vendor-released patch versions 4.20.3.1 and 4.22.1.1 address the issue.

RemediationAI

Upgrade to Apache CloudStack version 4.20.3.1 (for environments on the 4.20.x branch) or 4.22.1.1 (for environments on the 4.22.x branch), both of which resolve this issue per the Apache advisory at https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc. If immediate upgrade is not feasible, disable the OAuth authentication plugin entirely if it is not actively required - this eliminates the vulnerable code path with no impact on non-OAuth authentication methods such as LDAP or local accounts. Alternatively, restrict access to the CloudStack management API (typically TCP 8080/8443) to trusted internal IP ranges via firewall or security group rules, reducing the network-accessible attack surface. Note that network restriction alone does not eliminate the vulnerability for insiders or compromised internal hosts.

Affected VersionsENISA

Apache CloudStack 4.19.0.0 ≤4.20.3.0

Apache CloudStack 4.21.0.0 ≤4.22.1.0

Affected Packages

euvd apache_cloudstack no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) orchestration platform used to deploy and manage large-scale cloud environments. The OAuth authentication plugin extends CloudStack's identity federation capabilities by integrating external OAuth 2.0 providers. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause: the plugin's provider-listing routine returns sensitive OAuth configuration details - likely client IDs and client secrets - without enforcing authentication. The CPE string cpe:2.3:a:apache_software_foundation:apache_cloudstack:*:*:*:*:*:*:*:* covers all affected versions within the two branches noted. Because OAuth client secrets function as application-level credentials, their exposure allows an attacker to impersonate the CloudStack application in OAuth flows or pivot to the connected identity provider.

Know when Apache Cloudstack gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Unauthenticated network request triggers disclosure of OAuth secrets (C:H); no integrity or availability impact from passive information exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 25, 2026 - 20:22 NVD

7.5 (HIGH)

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.

This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Executive ViewAI

Why It Matters

Apache CloudStack deployments using OAuth authentication are at risk of credential exposure through a publicly accessible endpoint that leaks sensitive configuration to unauthenticated attackers. This threatens the integrity of federated identity systems and could enable attackers to compromise authentication controls for organizations relying on CloudStack's OAuth integration.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Implement strict network-level access controls to restrict the OAuth provider listing endpoint to authorized internal access only; (2) Rotate all OAuth credentials and secrets for connected services to invalidate any potentially exposed authentication material; (3) Enable detailed logging and alerting on OAuth configuration endpoint access attempts; (4) Temporarily disable OAuth authentication if operationally feasible and alternative authentication methods are available; (5) Isolate CloudStack management infrastructure within restricted network segments.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Medium

open-source IaaS platform deployed across mid-to-large enterprise and managed cloud providers

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.