CVE-2026-61397: Apache CloudStack: OAuth2 Token Cross-Request Leak

Q: Which CloudStack deployments are affected?

Deployments running versions 4.19.0.0 through 4.20.3.0, or 4.21.0.0 through 4.22.1.0, are affected when using the OAuth2 authentication plugin or Google OAuth integration.

Q: What is the recommended remediation?

Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, which contain the fix.

Published Aug 21, 2026

Updated

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.

This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.

Affected Software

1 affected component

Apache CloudStack>=4.19.0.0<=4.20.3.0, >=4.21.0.0<=4.22.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CloudStack to a version that resolves this vulnerability.
Fixed in 4.20.3.1
Upgrade
Upgrade Apache CloudStack to a version that resolves this vulnerability.
Fixed in 4.22.1.1

Event History

Aug 21, 2026

CVE Published

via MITRE·08:26 AM

Data Sourced

via MITRE·08:26 AM

DescriptionWeakness

Frequently Asked Questions

Which CloudStack deployments are affected?

Deployments running versions 4.19.0.0 through 4.20.3.0, or 4.21.0.0 through 4.22.1.0, are affected when using the OAuth2 authentication plugin or Google OAuth integration.

What is the recommended remediation?

Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, which contain the fix.