CVE-2026-61422: Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.
When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.20.3.1 - Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Apache CloudStack and able to use the template or ISO registration functionality. The issue is triggered when CloudStack performs a pre-validation HTTP HEAD or GET request to the supplied URL.
Is a malicious template or ISO actually downloaded through this vulnerability?
No. URL validation still occurs before the Secondary Storage VM performs the actual download, so the issue does not enable malicious template or ISO registration through the download path.
Which releases are affected and what should be upgraded?
Affected releases are 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrade to 4.20.3.1, 4.22.1.1, or a later release.