CVE-2026-59780: Apache CloudStack: LDAP provider configuration disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.
LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.
This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.20.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Who can access the exposed LDAP configuration data?
Any authenticated Apache CloudStack user that can access the listLdapConfigurations API can list LDAP configurations. By default, this API is available to all default roles.
Are default role configurations affected?
Yes. The listLdapConfigurations API is available to all default roles by default, so deployments using default role permissions may expose LDAP configuration data to authenticated users.
What versions resolve the issue?
Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, or a later version. The affected release ranges are 4.2.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0.