anonhaven

CVE-2026-59085

CRITICAL CVSS 3.1: 9.1 EPSS 0.33%
Updated Aug 27, 2026
Apache
Parameter Value
CVSS 9.1 (CRITICAL)
Affected Versions 4.20.0.0 — 4.22.1.1
Fixed In 4.20.3.1
Type CWE-918 (Server-Side Request Forgery (SSRF))
Vendor Apache
Public PoC No

Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

Vulnerable Products 2

Configuration From (including) Up to (excluding)
Apache Cloudstack
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*
 4.20.0.0 4.20.3.1
Apache Cloudstack
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*
 4.21.0.0 4.22.1.1

References 1

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
security@apache.org
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-84939

Apache

9.1

CVE-2026-73334

Apache

8.1

CVE-2026-65181

Java

8.1

CVE-2026-57866

Apache

8.8

CVE-2026-56207

Apache

9.8