This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apache CloudStack fixes 5 vulnerabilities

Apache CloudStack versions 4.19.3.0 and 4.20.1.0 fix five vulnerabilities [1].

ApacheCloudstack - sensitive information disclosure (CVE-2025-26521)
CVSS 8.8 (High)

An authenticated remote attacker who is a member of a project in which another user ('kubeadmin') created a CloudStack Kubernetes Service cluster can obtain that user's API key and secret key and perform privileged operations on their behalf. When the cluster is created, these credentials are automatically placed into Kubernetes as a secret and unintentionally made accessible to other project members as well. The procedure for updating existing Kubernetes clusters within projects can be found at [1].

The vulnerability is present in product:

  • Apache CloudStack; >=4.17.0.0, <=4.19.2.0; ==4.20.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

Apache CloudStack - sensitive information disclosure (CVE-2025-30675)
CVSS 4.7 (Medium)

An authenticated remote attacker with the Domain Admin or Resource Admin role can, due to insufficient validation of input parameters in the API methods 'listTemplates' and 'listIsos', breach domain isolation boundaries and enumerate potentially sensitive metadata of templates and ISO images from other domains, including ROOT [1][3].

The vulnerability is present in product:

  • Apache CloudStack; >=4.0.0, <=4.19.2.0; ==4.20.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

Apache CloudStack - privilege escalation (CVE-2025-47713)
CVSS 7.2 (High)

An authenticated remote attacker with the Domain Admin role in the ROOT domain can, due to insufficient permission checks, reset the passwords of users with the Admin role, take over a privileged administrator account and thereby escalate their privileges [1][4]. Information on the changes in the fixed version can be found at [1].

The vulnerability is present in product:

  • Apache CloudStack; >=4.10.0.0, <=4.19.2.0; ==4.20.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

Apache CloudStack - privilege escalation (CVE-2025-47849)
CVSS 7.2 (High)

An authenticated remote attacker with the Domain Admin role in the ROOT domain can obtain the API key and secret key of other users with the Admin role in the same domain due to insufficient permission checks, take control of a privileged administrator account and thereby escalate their privileges [1][5]. Information on the changes in the fixed version can be found at [1].

The vulnerability is present in product:

  • Apache CloudStack; >=4.10.0.0, <=4.19.2.0; ==4.20.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

Apache CloudStack Quota plugin - unauthorized access (CVE-2025-22829)
CVSS 2.3 (Low)

An authenticated remote attacker can modify the settings of certain e-mail notifications of any user in the system and view the related configuration due to insufficient permission checks, in an environment with the Quota plugin enabled and access to specific APIs [1][6].

The vulnerability is present in product:

  • Apache CloudStack; ==4.20.0.0;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 11. 6. 2025.

CESNET, z.s.p.o. Logo