Read the docs
TI-2024-28068 Aliases CVE-2024-42062GHSA-wrfv-q4v6-cw3x

Apache CloudStack: User Key Exposure to Domain Admins

Priority LOW 35CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.

Summary

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure. Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00946 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache CloudStack4.10.0 – 4.18.2.2; 4.19.0.0 – 4.19.1.0—No fix listedCNA
  • Apache CloudStack VendorApache Affected 4.10.0 – 4.18.2.2; 4.19.0.0 – 4.19.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*4.10.0.0 to before 4.18.2.3; 4.19.0.0 to before 4.19.1.1VulnerableApache
  • cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:* Versions 4.10.0.0 to before 4.18.2.3; 4.19.0.0 to before 4.19.1.1 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache CloudStack — cloudstack.apache.org/blog/security-release-advisory-4.19.1…

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-28213 Apache CloudStack: Unauthorised Network List AccessPriority LOW 22
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42062
  2. 2026-10-03 Alias added: GHSA-wrfv-q4v6-cw3x

References

Patch 1

Advisory 1

Other 1

  • TI-2024-27459 Apache CloudStack: SAML Signature Exclusion CVSS 3.1HIGH 8.1
  • TI-2024-25607 Apache CloudStack: Unauthenticated cluster service port leads to remote execution CVSS 3.1CRITICAL 9.8
  • TI-2022-16183 Apache CloudStack SAML Single Sign-On XXE CVSS 3.1CRITICAL 9.8
  • TI-2012-03843 Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers… CVSS 2.0HIGH 10.0
  • TI-2024-26763 Apache CloudStack: Integration API service uses dynamic port when disabled CVSS 3.1CRITICAL 9.8
  • TI-2016-05854 Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user… CVSS 3.1CRITICAL 9.8
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences