CVE-2026-59655: Apache CloudStack Information Disclosure

CVE-2026-59655 Overview

CVE-2026-59655 is an information disclosure vulnerability in the OAuth authentication plugin of Apache CloudStack. The flaw exposes sensitive OAuth provider configuration data to unauthorized actors when listing OAuth providers. The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

The vulnerability affects Apache CloudStack versions 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Apache released fixed versions 4.20.3.1 and 4.22.1.1 to remediate the issue. The vulnerability is exploitable over the network without authentication or user interaction.

Critical Impact
An unauthenticated remote attacker can retrieve sensitive OAuth provider information, potentially aiding downstream identity attacks against CloudStack deployments.

Affected Products

Apache CloudStack 4.19.0.0 through 4.20.3.0
Apache CloudStack 4.21.0.0 through 4.22.1.0
OAuth authentication plugin component

Discovery Timeline

2026-08-21 - CVE-2026-59655 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-59655

Vulnerability Analysis

The vulnerability resides in the OAuth authentication plugin used by Apache CloudStack to integrate external identity providers. When a client requests the list of configured OAuth providers, the API response returns fields that should be restricted to administrators or omitted entirely. Unauthorized callers can retrieve provider configuration details through this API path.

Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) platform used to build public, private, and hybrid clouds. The OAuth plugin allows CloudStack to delegate authentication to providers such as Google, GitHub, or enterprise identity systems. Exposure of provider metadata weakens the confidentiality of the identity integration.

The advisory does not indicate any impact to integrity or availability, and Apache has not published proof-of-concept code. Public exploit availability remains negative at the time of this writing.

Root Cause

The root cause is missing authorization enforcement on the API endpoint that lists OAuth providers. The listing operation returns provider fields without validating the caller's session or role. This violates the principle of least privilege and results in sensitive configuration data being disclosed to any network-reachable actor.

Attack Vector

Exploitation requires only network access to the CloudStack management server API. An attacker sends a request to the OAuth provider listing endpoint and parses the response for sensitive fields. No authentication, elevated privileges, or user interaction is required. Attackers can use the disclosed provider identifiers, client IDs, or callback configuration to plan further identity-focused attacks such as authorization code interception or phishing pages that impersonate legitimate providers.

No verified public exploit code is available. Refer to the Apache Mailing List Thread for the vendor advisory.

Detection Methods for CVE-2026-59655

Indicators of Compromise

Unauthenticated HTTP requests to the CloudStack management API invoking the listOauthProviders command or equivalent OAuth provider listing endpoint.
API access logs showing repeated requests from external or unexpected source IP addresses without a valid session cookie or API key.
Responses of HTTP 200 containing OAuth provider identifiers, client IDs, or redirect URIs served to unauthenticated clients.

Detection Strategies

Review CloudStack management server access logs for calls to OAuth-related API commands lacking authentication headers.
Correlate anomalous API enumeration patterns against the OAuth endpoints with subsequent login attempts against the same tenant.
Baseline normal administrative usage of OAuth configuration APIs and alert on deviations originating from non-administrative networks.

Monitoring Recommendations

Forward CloudStack management server API logs to a central SIEM or data lake for continuous inspection.
Monitor egress from the management server for unexpected outbound traffic that could indicate follow-on identity abuse.
Track version metadata across CloudStack deployments to identify unpatched hosts that remain exposed to CVE-2026-59655.

How to Mitigate CVE-2026-59655

Immediate Actions Required

Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later as directed by the vendor advisory.
Restrict network access to the CloudStack management server API to trusted administrative networks until the patch is applied.
Audit configured OAuth providers and rotate any client secrets that may have been referenced through the exposed listing endpoint.

Patch Information

Apache CloudStack fixed CVE-2026-59655 in versions 4.20.3.1 and 4.22.1.1. Deployments on the 4.19.x and 4.20.x branches must upgrade to 4.20.3.1 or later. Deployments on the 4.21.x and 4.22.x branches must upgrade to 4.22.1.1 or later. See the Apache Mailing List Thread for release notes.

Workarounds

Place the CloudStack management API behind a reverse proxy that enforces authentication and IP allow-listing.
Temporarily disable the OAuth authentication plugin if OAuth-based login is not required in the environment.
Apply web application firewall rules to block unauthenticated requests to the OAuth provider listing endpoint until patching is complete.

bash

# Configuration example: restrict CloudStack management API access at the reverse proxy
# nginx example limiting the OAuth listing endpoint to an internal admin CIDR
location /client/api {
    if ($arg_command = "listOauthProviders") {
        allow 10.10.0.0/24;
        deny all;
    }
    proxy_pass http://cloudstack-mgmt-backend;
}