CVE-2026-59085 Overview
CVE-2026-59085 is a Server-Side Request Forgery (SSRF) vulnerability in the webhook module of Apache CloudStack. Attackers exploit the flaw through webhook delivery requests, causing the CloudStack management server to issue attacker-controlled HTTP requests to internal or external destinations. The vulnerability affects Apache CloudStack from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The Apache CloudStack project has released fixed versions 4.20.3.1 and 4.22.1.1. The weakness maps to CWE-918: Server-Side Request Forgery.
Critical Impact
A network-based attacker without prior authentication can coerce CloudStack management infrastructure into contacting internal services, exposing confidential resources and enabling integrity impact on internal systems.
Affected Products
- Apache CloudStack 4.20.0.0 through 4.20.3.0
- Apache CloudStack 4.21.0.0 through 4.22.1.0
- Apache CloudStack deployments using the webhook module for event delivery
Discovery Timeline
- 2026-08-21 - CVE-2026-59085 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-59085
Vulnerability Analysis
Apache CloudStack's webhook module delivers event notifications to user-defined HTTP endpoints. The delivery logic accepts destination URLs without adequately restricting the schemes, hostnames, or IP address ranges the management server will contact. An attacker who can configure or trigger a webhook delivery causes the server to send outbound HTTP requests to arbitrary internal or external targets.
SSRF against a management-plane service is particularly impactful. CloudStack orchestrates hypervisors, storage, and networking, and it commonly runs adjacent to metadata services, internal databases, and management APIs that trust local network origin. The attacker uses the server as a proxy to reach these otherwise-unreachable services.
Root Cause
The root cause is missing validation on webhook destination URLs in the webhook delivery pipeline. The module does not enforce an allowlist of permitted hosts, does not block private and link-local address ranges, and does not restrict redirects to prevent DNS rebinding or scheme downgrade. See the Apache CloudStack advisory thread for maintainer discussion.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. The attacker registers or triggers a webhook whose target URL points to an internal address such as 127.0.0.1, 169.254.169.254, or an RFC1918 host. When CloudStack fires the webhook, the management server issues the request. Response contents, timing differences, or side effects on internal endpoints leak information or modify state.
Because no verified public proof-of-concept exists, defenders should treat the advisory-level description as authoritative and refer to the vendor advisory for technical detail.
Detection Methods for CVE-2026-59085
Indicators of Compromise
- Outbound HTTP or HTTPS requests originating from the CloudStack management server to internal address ranges such as 127.0.0.0/8, 169.254.0.0/16, or RFC1918 space.
- Webhook configuration entries whose destination URLs resolve to cloud metadata endpoints or loopback addresses.
- Unexpected access log entries on internal services showing the CloudStack management host as the client.
Detection Strategies
- Audit the CloudStack webhooks table and API history for destination URLs that reference internal, loopback, or metadata IP ranges.
- Correlate webhook delivery events in CloudStack logs with egress firewall telemetry to identify anomalous internal targets.
- Alert on DNS resolution from the management server for hostnames that map to private ranges shortly after webhook creation events.
Monitoring Recommendations
- Forward CloudStack management-server logs, webhook subsystem logs, and egress proxy logs to a central analytics platform for correlation.
- Baseline normal webhook destinations per tenant and alert on deviations, particularly first-seen internal destinations.
- Monitor for administrative API calls that create or modify webhook definitions from unusual source addresses or accounts.
How to Mitigate CVE-2026-59085
Immediate Actions Required
- Upgrade Apache CloudStack to 4.20.3.1 or 4.22.1.1 or later as recommended by the project.
- Inventory existing webhook definitions and remove any that reference internal, loopback, link-local, or metadata endpoints.
- Restrict who can create or modify webhooks by tightening role and account permissions on the management API.
Patch Information
The Apache CloudStack project fixed the SSRF in versions 4.20.3.1 and 4.22.1.1. Deployments on any 4.20.x release up to 4.20.3.0 must move to 4.20.3.1 or later. Deployments on 4.21.0.0 through 4.22.1.0 must move to 4.22.1.1 or later. Refer to the Apache announcement thread for release notes and upgrade guidance.
Workarounds
- Place the CloudStack management server behind an egress proxy that enforces an allowlist of external webhook destinations and denies private, loopback, and metadata ranges.
- Apply host-level firewall rules on the management server to block outbound connections to 127.0.0.0/8, 169.254.0.0/16, and RFC1918 ranges except where operationally required.
- Disable the webhook feature until patched if it is not used in the environment.
# Example egress restriction on the CloudStack management host
iptables -A OUTPUT -m owner --uid-owner cloud -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cloud -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cloud -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cloud -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cloud -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
