CVE-2026-65613 Overview
CVE-2026-65613 is an information disclosure vulnerability in the Apache CloudStack Webhook module. The flaw exposes sensitive information to unauthorized actors when listing and deleting webhook deliveries. Authenticated users with limited privileges can access delivery data belonging to other tenants or accounts.
The vulnerability affects Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Apache has released fixed versions 4.20.3.1 and 4.22.1.1. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Authenticated attackers with low-privilege access can enumerate and manipulate webhook delivery records, exposing sensitive payload data across tenant boundaries in multi-tenant CloudStack deployments.
Affected Products
- Apache CloudStack 4.20.0.0 through 4.20.3.0
- Apache CloudStack 4.21.0.0 through 4.22.1.0
- CloudStack deployments using the Webhook module for event delivery
Discovery Timeline
- 2026-08-21 - CVE-2026-65613 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-65613
Vulnerability Analysis
Apache CloudStack's Webhook module provides event-driven notifications by delivering HTTP callbacks to registered endpoints. The module exposes API operations for listing webhook deliveries and deleting delivery records. The vulnerability arises because these operations fail to enforce proper authorization checks on the requesting user's scope.
An authenticated user can invoke the list and delete delivery APIs and receive or modify records that fall outside their assigned account or domain. Webhook delivery payloads frequently contain sensitive operational data, including resource identifiers, event metadata, and API response contents. Cross-tenant visibility into this data undermines the isolation guarantees expected in multi-tenant cloud environments.
Root Cause
The root cause is missing or insufficient access control enforcement in the delivery listing and deletion code paths of the Webhook module. The API handlers do not correctly restrict results to entities owned by the caller's account or domain. This maps to CWE-200, exposure of sensitive information to an unauthorized actor.
Attack Vector
Exploitation requires network access to the CloudStack management API and valid user credentials with low privileges. No user interaction is required. An attacker with a standard account queries the webhook delivery endpoints and receives records associated with other accounts. The same authorization gap allows deletion of those records, which can also disrupt auditability.
The vulnerability manifests in the Webhook module's delivery API handlers. Refer to the Apache Mailing List Discussion for the official advisory.
Detection Methods for CVE-2026-65613
Indicators of Compromise
- Unexpected listWebhookDeliveries or deleteWebhookDelivery API calls from low-privilege accounts.
- Access to webhook delivery identifiers that do not belong to the caller's account or domain.
- Missing webhook delivery records that were previously present in audit logs.
Detection Strategies
- Audit CloudStack management server API logs for webhook delivery API calls issued by non-administrative users.
- Correlate webhook delivery API requests with the caller's account scope to identify cross-tenant access attempts.
- Compare current webhook delivery counts against historical baselines to detect anomalous deletions.
Monitoring Recommendations
- Enable verbose API access logging on the CloudStack management server and forward events to a central SIEM.
- Alert on any webhook delivery deletion event, especially those originating from user accounts rather than administrators.
- Review domain and account access patterns weekly for unexpected cross-tenant API usage.
How to Mitigate CVE-2026-65613
Immediate Actions Required
- Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later as published by the Apache CloudStack project.
- Audit existing webhook configurations and delivery records for signs of unauthorized listing or deletion.
- Rotate any credentials, tokens, or secrets that may have been transmitted in webhook payloads exposed by this issue.
Patch Information
Apache has fixed the vulnerability in Apache CloudStack 4.20.3.1 and 4.22.1.1. Administrators running versions in the ranges 4.20.0.0 through 4.20.3.0 or 4.21.0.0 through 4.22.1.0 should upgrade immediately. See the Apache Mailing List Discussion for release details.
Workarounds
- Restrict access to the CloudStack management API using network-level controls until patches are applied.
- Disable or unregister webhooks that carry sensitive payloads in affected deployments.
- Limit account creation and review existing low-privilege accounts to reduce the pool of potential attackers.
# Verify the running CloudStack management server version
rpm -q cloudstack-management || dpkg -l | grep cloudstack-management
# After upgrade, confirm the fixed version is installed
# Expected: 4.20.3.1, 4.22.1.1, or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
