PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61397 Apache Software Foundation CVE debrief

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue. The vulnerability allows unauthorized actors to access sensitive information due to improper handling of authentication tokens. Affected users should prioritize upgrading to fixed versions to mitigate potential unauthorized access. Additionally, operators and administrators of affected platforms must review and address this vulnerability promptly.

Vendor
Apache Software Foundation
Product
Apache CloudStack
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-21
Original CVE updated
2026-08-27
Advisory published
2026-08-21
Advisory updated
2026-08-27

Who should care

Users of Apache CloudStack versions 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, and security teams responsible for vulnerability management, should review and address this vulnerability. Operators and administrators of affected platforms must prioritize upgrading to fixed versions to prevent potential unauthorized access.

Technical summary

The vulnerability affects Apache CloudStack versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. It is recommended to upgrade to version 4.20.3.1 or 4.22.1.1. The issue involves Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This vulnerability can lead to unauthorized access to sensitive information, emphasizing the need for prompt upgrades to fixed versions. Security teams should review affected systems and implement compensating controls where necessary.

Defensive priority

Upgrade to fixed versions

Recommended defensive actions

  • Upgrade to version 4.20.3.1 or 4.22.1.1
  • Review and update affected Apache CloudStack versions
  • Monitor for potential unauthorized access
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-08-21T09:16:39.363Z. The NVD entry is currently Received. Evidence is limited to CVE and NVD details. Defenders should verify affected Apache CloudStack versions and review official advisories for specific guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-61397 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-61397

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-61397 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-61397

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.