CVE-2026-61422 in CloudStack
Summary
by MITRE • 08/21/2026
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.
When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Apache CloudStack represents a critical flaw within the template and ISO registration workflow, specifically classified as an authenticated pre-validation Server-Side Request Forgery (SSRF). This security defect arises from the sequence of operations performed by the management server when handling user requests to register new virtual machine templates or installation media. Upon receiving such a request, the system initiates a live HTTP HEAD or GET call to the provided URL before executing any validation logic on that URL string. The primary purpose of this initial network interaction is to determine the file size of the remote resource, which is necessary for calculating secondary storage usage limits and ensuring quota compliance. However, because this outbound request occurs prior to strict URL validation, an authenticated attacker can manipulate the input parameters to force the CloudStack management server to initiate connections to arbitrary internal or external destinations that would otherwise be blocked by subsequent security checks.
From a technical perspective, the core issue lies in the lack of immediate sanitization and allow-listing mechanisms before network I/O operations are initiated. While the system does perform URL validation later in the process—specifically prior to the actual download operation executed by the Secondary Storage VM—the premature nature of the initial probe allows for information disclosure or potential exploitation of internal services that do not require authentication themselves. This pre-validation SSRF vector enables an attacker with valid credentials on the CloudStack platform to interact with backend infrastructure, potentially mapping out internal network topologies, accessing sensitive management interfaces, or triggering requests against other vulnerable services residing within the same trust zone as the hypervisor hosts and storage systems. The impact is significant because it bypasses the intended security boundary that should prevent external inputs from influencing internal network traffic patterns before they are deemed safe.
The operational impact of this vulnerability extends beyond simple information disclosure. By leveraging SSRF, an attacker could potentially probe for open ports on internal servers, detect running services such as databases or administrative consoles, and even attempt to exploit known vulnerabilities in those backend systems if the management server has network access to them. This effectively expands the attack surface from a single application-level flaw into a broader infrastructure compromise scenario. Although the vulnerability does not allow for direct malicious template registration due to subsequent validation steps, it serves as a powerful reconnaissance tool that can facilitate further attacks against the cloud environment's underlying components. The risk is particularly acute in multi-tenant environments where isolation between tenants and management systems relies heavily on strict network controls and input sanitization practices.
To mitigate this vulnerability, organizations running affected versions of Apache CloudStack must prioritize immediate software updates. The recommended course of action involves upgrading to version 4.20.3.1 or any version within the 4.22.x branch starting from 4.22.1.1 and later. These releases contain patches that reorder the validation logic, ensuring that URL sanitization and allow-listing checks are performed before any outbound network requests are initiated by the management server. In addition to upgrading, administrators should review their firewall rules and network segmentation strategies to limit the ability of CloudStack management servers to initiate connections to unauthorized internal subnets. Implementing strict egress filtering can provide a defense-in-depth layer that mitigates the impact even if similar vulnerabilities arise in future updates.
This incident aligns with common vulnerability classifications such as CWE-918, which addresses Server-Side Request Forgery (SSRF) flaws where server-side code makes requests to user-supplied URLs without proper validation. Furthermore, it relates to ATT&CK technique T1571, specifically the Non-Standard Port or Protocol aspect of SSRF, and potentially T1046 for Service Discovery if used for network mapping. Security teams should treat this as a high-priority remediation item due to its potential to facilitate lateral movement within cloud infrastructure environments. Regular auditing of input validation sequences in all web-facing components is essential to prevent similar pre-validation flaws from being introduced into other modules of the platform.