TI-2025-21948 CVE-2025-30675 · GHSA-9wjh-qx89-88ff
Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins
Priority LOW 23
In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs.
Vulnerabilities
4 records
Advisory: Apache CloudStack — cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0 Clear all filters
TI-2025-19459 CVE-2025-26521 · GHSA-r5jq-h47c-74h3
Apache CloudStack: CKS cluster in project exposes user API keys
Priority LOW 38
When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-bas…
TI-2025-30280 CVE-2025-47849 · GHSA-2wpw-3v5g-3wff
Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain
Priority MEDIUM 41
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role…
TI-2025-30210 CVE-2025-47713 · GHSA-qmmh-h9p5-p2f7
Apache CloudStack: Domain Admin can reset Admin password in Root Domain
Priority MEDIUM 41
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type.