CVE-2026-68745

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures. Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack:4.22.1.0:::::::*

History

16 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Fallos en la validación de certificados en la autenticación SAML en Apache CloudStack 4.20.3.0 y 4.22.1.0 en todas las plataformas permiten a un agente malicioso falsificar una respuesta SAML al servidor de gestión. El agente tendrá que suplantar la dirección IP del IdP o conseguir que una URL de su elección sea registrada en el servidor de gestión, después de lo cual puede permitir el inicio de sesión con firmas falsificadas. Se recomienda a los usuarios actualizar a las versiones 4.20.3.1 o 4.22.1.1 y superiores, que solucionan este problema.

Information

Published : 2026-08-21 09:16

Updated : 2026-10-16 15:10

NVD link : CVE-2026-68745

Mitre link : CVE-2026-68745

CVE.ORG link : CVE-2026-68745

JSON object : View

Products Affected

apache

cloudstack

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-68745", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68745", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T16:58:22.730291Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.5.2", "versionType": "semver", "lessThanOrEqual": "4.20.3.0"}, {"status": "affected", "version": "4.21.0.0", "versionType": "semver", "lessThanOrEqual": "4.22.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T09:16:40.697", "references": [{"url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.\n\nUsers are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue."}, {"lang": "es", "value": "Fallos en la validaci\u00f3n de certificados en la autenticaci\u00f3n SAML en Apache CloudStack 4.20.3.0 y 4.22.1.0 en todas las plataformas permiten a un agente malicioso falsificar una respuesta SAML al servidor de gesti\u00f3n. El agente tendr\u00e1 que suplantar la direcci\u00f3n IP del IdP o conseguir que una URL de su elecci\u00f3n sea registrada en el servidor de gesti\u00f3n, despu\u00e9s de lo cual puede permitir el inicio de sesi\u00f3n con firmas falsificadas.\n\nSe recomienda a los usuarios actualizar a las versiones 4.20.3.1 o 4.22.1.1 y superiores, que solucionan este problema."}], "lastModified": "2026-10-16T15:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD7719FD-B350-40F9-8562-27D10DAE2220", "versionEndExcluding": "4.20.3.1", "versionStartIncluding": "4.5.2"}, {"criteria": "cpe:2.3:a:apache:cloudstack:4.22.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20E2AEEA-1375-4078-ABFB-04A1D1F2470C"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}