Apache CloudStack CVE-2026-59657

Exploitation requires read access to the Apache CloudStack backend database, specifically the table(s) used to store AsyncJob state and results. The attacker does not need CloudStack management-plane credentials if they obtain direct database access through a separate vector (e.g., compromised DB credentials, SQL injection in a co-located application, exposed backup file, or cloud storage misconfiguration). Exploitation through the CloudStack API itself would require at minimum a valid CloudStack user account to query AsyncJob results. What limits exploitation: the CloudStack database is not directly internet-facing in well-configured deployments; exploitation depends on a secondary access vector to the database layer; and the sensitive content of AsyncJob records depends on which operations users perform through the API. Environments with strict database network segmentation and encrypted backup storage significantly reduce real-world risk despite the high CVSS score.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N) implies unauthenticated network exploitation, but this is misleading for a storage vulnerability of this class. CWE-312 flaws are exploited by reading stored data, not by triggering a network-reachable flaw directly. Realistically, an attacker must first obtain database-level read access (via a separate SQL injection, compromised DB credentials, insider threat, insecure backup, or snapshot misconfiguration) - making the effective attack complexity higher than AC:L/PR:N suggests. EPSS at 0.10% (1st percentile) corroborates that automated or widespread exploitation is not observed. No KEV listing confirms no CISA-tracked active exploitation. However, the severity is real in environments with shared database infrastructure, multi-tenant cloudstack deployments, or any path to DB credential exposure. The CVSS C:H rating is accurate - if AsyncJob records capture secrets, exposure is complete for those values. The NVD's PR:N appears to model the CloudStack application layer as having no privilege barrier to AsyncJob data in certain retrieval paths, but this conflicts with the expectation that API-level AsyncJob queries require at minimum user authentication. This discrepancy should be verified with the vendor.

An attacker who obtains read access to the CloudStack MySQL database - through a separately exploited SQL injection in another application sharing the DB host, through leaked backup files, or via compromised database credentials - queries the async_job table and extracts sensitive values stored in cleartext that were originally submitted as part of asynchronous CloudStack API operations. No public exploit code exists for this vulnerability at the time of analysis.