EUVD-2026-63840
GHSA-ppcf-cpj8-62xr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify CloudStack instance with OAuth2/Google OAuth plugin enabled
-
ExploitSend unauthenticated crafted OAuth2 authentication request
-
ExecutionTrigger CWE-200 disclosure in plugin handling logic
-
ImpactRetrieve exposed sensitive information (OAuth tokens or identity data)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Apache CloudStack OAuth2 authentication plugin or the Google OAuth integration be explicitly enabled by an administrator - this is a non-default configuration that must be deliberately activated. Once enabled, the flaw is exploitable remotely by unauthenticated actors with network access to the CloudStack management interface (confirmed by AV:N/PR:N in the CVSS vector). What limits exploitation: CloudStack deployments using only native username/password, LDAP, or SAML authentication without OAuth2/Google OAuth are not affected by this vulnerability. Only versions within the two specified ranges (4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) are vulnerable; deployments already on 4.20.3.1, 4.22.1.1, or earlier unaffected versions fall outside the risk window. |
| Impact | The vendor-assigned CVSS 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a worst-case exposure: network-reachable, no credential required, no user interaction needed, and high confidentiality impact. Real-world risk is meaningfully scoped, however, because exploitation requires the OAuth2 or Google OAuth plugin to be explicitly enabled - this is not a default CloudStack configuration, which limits the total exposed population. EPSS at 0.17% (7th percentile) is well below any threshold associated with active or opportunistic exploitation campaigns, and no CISA KEV listing has been confirmed. The absence of integrity and availability impact (I:N/A:N) constrains the blast radius to information disclosure - serious but not a full system compromise. Overall assessment: genuine priority for organizations running affected versions with OAuth2 enabled; lower urgency for those using native authentication only. KEV status and POC availability are unconfirmed from available data - monitor for updates. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a CloudStack management endpoint where the OAuth2 or Google OAuth plugin is enabled, then sends a specially crafted OAuth2 authentication request that triggers the CWE-200 information disclosure path. Because AC:L and PR:N apply, no special timing, race conditions, or prior credentials are required - the attacker receives sensitive data such as OAuth tokens or user identity material directly in the response. No public exploit code is confirmed at time of analysis, but the low complexity makes independent development straightforward once the flaw mechanics are understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Aug 25, 2026
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows unauthenticated remote attackers to access high-confidentiality data across two affected version ranges. The flaw is network-reachable with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), making it a genuine High-severity finding for any CloudStack deployment with OAuth2 or Google OAuth enabled. EPSS sits at 0.17% (7th percentile) and no CISA KEV listing exists, suggesting no public exploitation activity at time of analysis; however, the low attack complexity and zero privilege requirement keep real-world risk elevated for affected configurations.
Earlier versions of this analysis (2)
Sensitive information disclosure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration exposes confidential data to unauthenticated remote actors. Affected deployments span two release branches: 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. Despite a high CVSS score of 7.5 with a fully unauthenticated network vector, the EPSS score of 0.17% (7th percentile) and absence of both CISA KEV listing and public exploit code indicate no confirmed active exploitation at time of analysis.
Information disclosure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration (versions 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) exposes sensitive data to unauthorized actors, per Apache's own advisory. The flaw lives in the SSO/OAuth path of this IaaS cloud orchestration platform, meaning environments that enabled OAuth2 login could leak authentication-related information. No public exploit identified at time of analysis, and no CVSS or EPSS scoring is available to gauge exploitation likelihood.
RemediationAI
The Apache Software Foundation has released patched versions 4.20.3.1 (for the 4.19-4.20 branch) and 4.22.1.1 (for the 4.21-4.22 branch); upgrading to either of these versions is the recommended primary fix, as confirmed in the advisory at https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc. For environments where immediate patching is not operationally feasible, disabling the OAuth2 authentication plugin and Google OAuth integration is the most effective compensating control - note this will break SSO/federated login for users relying on those flows and force migration to alternate authentication methods such as LDAP or native CloudStack credentials. Additionally, restricting network access to the CloudStack management API and UI to trusted IP ranges reduces the unauthenticated network attack surface described by AV:N/PR:N, with the trade-off of operational inconvenience for remote administrators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) platform that supports multiple authentication backends including OAuth2 and Google OAuth for federated identity. The vulnerability resides in the OAuth2 authentication plugin and its Google OAuth integration - components that broker identity tokens and credentials between CloudStack and external identity providers during the authentication handshake. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as improper disclosure of sensitive data - likely OAuth tokens, client secrets, or user identity material - to parties not authorized to receive it. The affected software is identified by CPE cpe:2.3:a:apache_software_foundation:apache_cloudstack across two discontiguous version ranges, indicating the flaw was introduced in 4.19.0.0 and persisted through both stable and development branches until patched releases corrected it.
Know when Apache Cloudstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OAuth2 plugin is network-accessible with no authentication required; impact is confidentiality-only with no integrity or availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.
This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.
Articles & Coverage 2
Executive ViewAI
Apache CloudStack installations using OAuth2 authentication face unauthenticated remote access to sensitive infrastructure management data, creating direct risk of credential theft and unauthorized configuration changes. Organizations deploying CloudStack are exposed to data compromise without requiring any user credentials or interaction; this vulnerability poses both immediate operational security risk and regulatory compliance exposure if the deployment handles customer workloads or sensitive configurations.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to CloudStack OAuth endpoints via firewall ACLs and Web Application Firewall policies to authorized administrative networks only; implement API rate limiting on OAuth endpoints; enable comprehensive audit logging for OAuth authentication events and access attempts; deploy network segmentation to isolate affected CloudStack instances from untrusted networks; consider disabling OAuth2/Google OAuth authentication in favor of alternative methods (LDAP, SAML, local directory) if operationally feasible; establish continuous monitoring for exploitation indicators; prepare incident response procedures addressing potential compromise of infrastructure management credentials and system configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Unauthorized cross-tenant access in Apache CloudStack 4.21.0 through 4.22.0 allows remote unauthenticated attackers to g
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
Remote code execution in Apache CloudStack allows authenticated account users to execute arbitrary code on KVM hyperviso
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Apache CloudStack deployments that use MinIO-backed object storage fail to revoke the MinIO policy associated with a buc
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to an
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating o
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issui
Exploit-DB