CVE-2026-61422: Apache CloudStack SSRF Vulnerability

CVE-2026-61422 Overview

CVE-2026-61422 is an authenticated pre-validation Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's template and ISO registration functionality. When a user registers a template or ISO, CloudStack issues a live HTTP HEAD/GET request to determine file size for secondary storage usage-limit checks before URL validation runs. An authenticated attacker can abuse this behavior to make the CloudStack management server issue outbound HTTP requests to arbitrary URLs. The issue affects Apache CloudStack 4.20.3.0 and versions 4.21.0.0 through 4.22.1.0. Fixed releases 4.20.3.1 and 4.22.1.1 enforce URL validation before the pre-check request.

Critical Impact
An authenticated attacker can coerce the CloudStack management server into making outbound HTTP requests to attacker-chosen internal or external endpoints, enabling limited reconnaissance of internal services.

Affected Products

Apache CloudStack 4.20.3.0
Apache CloudStack 4.21.0.0 through 4.22.1.0
Fixed in Apache CloudStack 4.20.3.1 and 4.22.1.1

Discovery Timeline

2026-08-21 - CVE-2026-61422 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-61422

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under CWE-918. Apache CloudStack performs a preliminary HTTP HEAD or GET request against the URL supplied during template or ISO registration. The purpose of that request is to obtain the Content-Length header so CloudStack can enforce secondary storage usage limits.

Because the pre-check runs before URL validation, an authenticated user can supply URLs pointing to internal network hosts, cloud metadata services, or other endpoints not intended to be reachable from outside. The management server itself performs the outbound request, giving the attacker a network position they would not otherwise have.

The advisory clarifies that this does not allow malicious templates or ISOs to be downloaded, because URL validation still occurs before the Secondary Storage VM (SSVM) performs the actual file transfer. The impact is therefore limited to information disclosure through the pre-check request and its response metadata.

Root Cause

The root cause is an ordering flaw in the template and ISO registration workflow. CloudStack invokes the outbound HTTP probe for storage accounting before it applies the URL allow-list and scheme checks that gate later stages. Any input that reaches the registration API is treated as trusted for the purpose of the size probe.

Attack Vector

Exploitation requires an authenticated CloudStack account with permission to register templates or ISOs. The attacker submits a registration request with a URL targeting an internal resource, for example a private management interface, a cloud provider instance metadata endpoint, or an internal HTTP service. CloudStack's management server issues the HEAD or GET request, and response characteristics such as status codes, timing, and returned headers can be inferred by the attacker.

The vulnerability is described in the Apache CloudStack mailing list advisory.

Detection Methods for CVE-2026-61422

Indicators of Compromise

Template or ISO registration API calls (registerTemplate, registerIso) containing URLs that resolve to RFC1918 addresses, localhost, 169.254.169.254, or other internal-only hostnames.
Outbound HTTP HEAD or GET requests from the CloudStack management server to unexpected internal endpoints shortly after a registration API call.
Repeated failed registration attempts from the same account probing varying internal IP addresses or ports.

Detection Strategies

Correlate CloudStack API audit logs for registerTemplate and registerIso events with egress network flow logs from the management server.
Alert on registration URLs whose hostnames resolve to internal subnets, link-local addresses, or cloud metadata IPs.
Baseline normal template repository domains and flag registrations pointing to previously unseen destinations.

Monitoring Recommendations

Forward CloudStack management server access logs and API audit logs to a centralized analytics platform for correlation with network telemetry.
Monitor outbound connections from the management server and restrict them to known template repositories at the network layer.
Track authenticated user activity for anomalous volumes of template or ISO registration attempts.

How to Mitigate CVE-2026-61422

Immediate Actions Required

Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later as recommended by the project.
Audit accounts that hold template and ISO registration privileges and remove entitlements that are not required.
Review recent registerTemplate and registerIso API calls for URLs targeting internal or metadata endpoints.

Patch Information

Apache CloudStack has released fixed versions 4.20.3.1 and 4.22.1.1. These releases enforce URL validation before the pre-registration size check, closing the SSRF path. Details are available in the Apache CloudStack security advisory.

Workarounds

Restrict egress from the CloudStack management server using host firewalls or network ACLs, permitting only trusted template repository destinations.
Deploy an outbound HTTP proxy in front of the management server with an allow-list of approved template and ISO source domains.
Limit template and ISO registration permissions to a small set of trusted administrator roles until patching is complete.

bash

# Example egress restriction on the CloudStack management server (iptables)
# Allow only the approved template repository, drop other outbound HTTP/HTTPS
iptables -A OUTPUT -p tcp -d templates.example.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80  -j REJECT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT