Authenticated Pre-Validation Vulnerability in Apache CloudStack

CVE-2026-61422

What is CVE-2026-61422?

An authenticated pre-validation Server-Side Request Forgery (SSRF) vulnerability exists in Apache CloudStack, affecting its template and ISO registration functions. During these processes, CloudStack performs live HTTP HEAD/GET requests to determine file sizes for secondary storage usage-limit verifications before successfully validating URLs. Although the initial URL validation occurs later during the actual download by the Secondary Storage VM, this pre-validation step poses a risk that malicious actors could exploit. Users are strongly advised to upgrade to version 4.20.3.1 or 4.22.1.1 or later to mitigate this vulnerability and enhance the security of their CloudStack instances.

References