Apache CloudStack EUVD-2026-63830

SAML authentication must be enabled and configured in the Apache CloudStack management server - this is a non-default feature that requires explicit setup. The attacker must satisfy one of two preconditions: (1) successfully spoof the IP address of the registered Identity Provider so that the management server accepts the forged SAML response as originating from the trusted IdP, or (2) have a URL under their control registered as a trusted IdP endpoint within the management server configuration, which itself may require prior administrative access or misconfiguration. Environments not using SAML federation (using local accounts or LDAP instead) are entirely unaffected. Exploitation is further constrained by AC:H in the CVSS vector, confirming that the prerequisite network position or configuration access is not trivially obtained. Authentication to CloudStack is not required prior to exploitation, as the attack targets the authentication mechanism itself (PR:N per CVSS vector).

The NVD CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the dual nature of this vulnerability: the impact is severe (full C/I/A compromise of the management plane) but the attack complexity is genuinely high. AC:H reflects that the attacker must satisfy one of two non-trivial preconditions - perform IP spoofing of the legitimate IdP, or somehow register a malicious URL as a trusted IdP endpoint in the management server (which itself may require some prior access or social engineering). The EPSS score of 0.07% at percentile 0% confirms that exploitation is not currently observed in the wild, and there is no CISA KEV listing. There is no confirmed public POC. The practical risk profile is therefore medium-high for organizations actively using SAML-federated authentication in CloudStack: if an adversary achieves the prerequisite network position or IdP URL registration, the payoff is complete infrastructure control. Organizations not using SAML authentication are not exposed by this vulnerability regardless of version.

An attacker on a network path capable of intercepting or spoofing traffic from the legitimate IdP, or one who has registered a malicious endpoint as a trusted IdP URL in the CloudStack management server, crafts a SAML assertion asserting administrative identity and submits it to the management server's SAML callback. Because the management server does not properly verify the cryptographic signature, the forged assertion is accepted and the attacker gains authenticated access as the impersonated user - potentially a cloud administrator - without possessing any valid credentials. No public POC has been identified at time of analysis.