CVE-2026-59799: Apache CloudStack Auth Bypass Vulnerability

CVE-2026-59799 Overview

CVE-2026-59799 is an Improper Privilege Management vulnerability [CWE-269] in the Two-factor authentication (2FA) plugin of Apache CloudStack. The flaw lets an authenticated user bypass the disable flow that governs 2FA, weakening account protection on affected deployments. The issue affects Apache CloudStack versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Apache recommends upgrading to 4.20.3.1, 4.22.1.1, or later.

Critical Impact
An authenticated attacker can bypass the 2FA disable workflow over the network, undermining a control designed to prevent unauthorized account access to CloudStack management functions.

Affected Products

Apache CloudStack 4.18.0.0 through 4.20.3.0
Apache CloudStack 4.21.0.0 through 4.22.1.0
Fixed versions: Apache CloudStack 4.20.3.1 and 4.22.1.1

Discovery Timeline

2026-08-21 - CVE-2026-59799 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-59799

Vulnerability Analysis

Apache CloudStack ships a Two-factor authentication plugin that adds a second verification step to user logins. CVE-2026-59799 exists in the code path that governs disabling 2FA on user accounts. Access to that flow is not properly restricted, so an authenticated user can trigger it in ways the plugin was intended to prevent.

Because the plugin operates at the account-security layer, an adversary who bypasses the disable flow can reduce assurance on accounts that administrators believed were protected. In multi-tenant Apache CloudStack deployments, this affects the trust boundary between orchestration operators and consumers of the cloud.

Root Cause

The vulnerability is an Improper Privilege Management flaw [CWE-269]. The Two-factor authentication plugin does not enforce the privilege checks needed to gate the 2FA disable operation. Requests that should be rejected proceed and mutate the authentication state associated with a targeted account.

Attack Vector

Exploitation is remote and requires low-privilege authentication with no user interaction. An attacker submits requests to the CloudStack management API and interacts with the 2FA plugin's disable workflow. On success, 2FA protection on the affected account is removed, enabling follow-on attacks against the CloudStack control plane and any hypervisors, storage pools, or tenant resources it manages.

See the Apache Mailing List Discussion for the vendor announcement.

Detection Methods for CVE-2026-59799

Indicators of Compromise

Unexpected disable2FA or equivalent 2FA-management API calls in the CloudStack management-server logs, particularly from non-administrative accounts.
User accounts whose 2FA status transitions from enabled to disabled without an associated administrator action or a legitimate self-service request.
Successful logins to CloudStack accounts that previously required 2FA but completed without a second factor.

Detection Strategies

Correlate CloudStack API audit events for 2FA state changes with the authenticated user, source IP, and preceding session activity to spot bypass attempts.
Alert on 2FA disable events that are not paired with the expected user-initiated confirmation step defined by the plugin's intended flow.
Baseline normal 2FA administration activity per tenant and flag deviations, especially bursts of disable operations across multiple accounts.

Monitoring Recommendations

Forward CloudStack management-server logs and API audit trails to a central analytics platform for continuous review.
Track authentication outcomes on privileged CloudStack accounts and page on 2FA-disabled logins.
Review orchestration actions (VM creation, credential resets, API key generation) that follow any 2FA state change to identify post-bypass abuse.

How to Mitigate CVE-2026-59799

Immediate Actions Required

Upgrade Apache CloudStack to 4.20.3.1, 4.22.1.1, or a later release that includes the fix.
Inventory user accounts and audit 2FA status, re-enabling 2FA on any account whose configuration changed unexpectedly.
Rotate API keys and secrets for CloudStack accounts that may have operated without 2FA during the exposure window.

Patch Information

Apache CloudStack 4.20.3.1 and 4.22.1.1 remediate CVE-2026-59799 by correcting privilege enforcement in the Two-factor authentication plugin's disable flow. Refer to the Apache Mailing List Discussion for release details and upgrade guidance.

Workarounds

Restrict network reachability to the CloudStack management API so only trusted operator networks and jump hosts can invoke authentication endpoints.
Limit account creation and enforce least privilege on existing CloudStack accounts to reduce the population of users who can authenticate and reach the 2FA plugin.
Increase audit-log review frequency for 2FA state changes until the upgrade is deployed across all management servers.

bash

# Verify the running Apache CloudStack management-server version
# and confirm it is at or above a fixed release (4.20.3.1 or 4.22.1.1)
cloudstack-management --version

# Example: query 2FA status per user via the CloudStack API
# Replace ENDPOINT, APIKEY, and SIGNATURE per your environment
curl -sS "https://ENDPOINT/client/api?command=listUsers&response=json&apikey=APIKEY&signature=SIGNATURE" \
  | jq '.listusersresponse.user[] | {username, is2faenabled, account, domain}'