CVE-2026-61397 Apache Software Foundation CVE debrief

Who should care

Users of Apache CloudStack versions 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, and security teams responsible for vulnerability management, should review and address this vulnerability. Operators and administrators of affected platforms must prioritize upgrading to fixed versions to prevent potential unauthorized access.

Technical summary

The vulnerability affects Apache CloudStack versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. It is recommended to upgrade to version 4.20.3.1 or 4.22.1.1. The issue involves Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This vulnerability can lead to unauthorized access to sensitive information, emphasizing the need for prompt upgrades to fixed versions. Security teams should review affected systems and implement compensating controls where necessary.

Defensive priority

Upgrade to fixed versions

Recommended defensive actions

• Upgrade to version 4.20.3.1 or 4.22.1.1
• Review and update affected Apache CloudStack versions
• Monitor for potential unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-08-21T09:16:39.363Z. The NVD entry is currently Received. Evidence is limited to CVE and NVD details. Defenders should verify affected Apache CloudStack versions and review official advisories for specific guidance.

Official resources