CVE-2026-59655: Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

Q: Which CloudStack deployments are affected?

Deployments running versions 4.19.0.0 through 4.20.3.0, or 4.21.0.0 through 4.22.1.0, are affected.

Q: What must an attacker be able to do to obtain the OAuth client secret?

The issue occurs when listing OAuth providers and is described as unauthenticated, so an attacker does not need to authenticate to exploit that exposed functionality.

Q: What should teams do to remediate the issue?

Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, or a later version.

Published Aug 21, 2026

Updated

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.

This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Affected Software

2 affected components

Apache CloudStack>=4.19.0.0<=4.20.3.0, >=4.21.0.0<=4.22.1.0

Apache CloudStack<4.20.3.1, <4.22.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CloudStack to a version that resolves this vulnerability.
Fixed in 4.20.3.1
Upgrade
Upgrade Apache CloudStack to a version that resolves this vulnerability.
Fixed in 4.22.1.1

Event History

Aug 21, 2026

CVE Published

via MITRE·08:28 AM

Data Sourced

via MITRE·08:28 AM

DescriptionWeakness

Frequently Asked Questions

Which CloudStack deployments are affected?

Deployments running versions 4.19.0.0 through 4.20.3.0, or 4.21.0.0 through 4.22.1.0, are affected.

What must an attacker be able to do to obtain the OAuth client secret?

The issue occurs when listing OAuth providers and is described as unauthenticated, so an attacker does not need to authenticate to exploit that exposed functionality.

What should teams do to remediate the issue?