Improper Encoding in Apache CloudStack's UI for Password Reset Functionality
CVE-2026-61398

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Cloudstack
Vendor
CVE Published:
21 August 2026

What is CVE-2026-61398?

An output encoding vulnerability exists in the Apache CloudStack UI when using the Instance Reset Password functionality. This flaw could potentially allow attackers to exploit improper handling of output data, posing security risks. It affects versions ranging from Apache CloudStack 4.15.1.0 to 4.22.1.0. Users are strongly advised to update to version 4.20.3.1 or 4.22.1.1 or later to mitigate this risk.

Affected Version(s)

Apache CloudStack 4.15.1.0 <= 4.20.3.0

Apache CloudStack 4.21.0.0 <= 4.22.1.0

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3f...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Łukasz Bawolski <Lukasz.Bawolski@exea.pl>
.