CVE-2026-59657CWE-312

CVE-2026-59657

High · published August 21, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.

This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.8th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-08-21T13:16Z
Affected products (2)
ProductVersionsFixed in
apache/cloudstack≥ 4.0.0, < 4.20.3.14.20.3.1
apache/cloudstack≥ 4.21.0.0, < 4.22.1.14.22.1.1
References (1)
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc · [email protected]
EPSS history
Timeline
  • 21 AUG 08:27Z
    Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
    cvelistv5