CVE-2026-61397CWE-200information-disclosure

CVE-2026-61397

High · published August 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.

This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00595 · 47.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-21T13:16Z
Affected products (2)
ProductVersionsFixed in
apache/cloudstack≥ 4.19.0.0, < 4.20.3.14.20.3.1
apache/cloudstack≥ 4.21.0.0, < 4.22.1.14.22.1.1
References (1)
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc · [email protected]
EPSS history
Timeline
  • 21 AUG 08:26Z
    Apache CloudStack: OAuth2 Token Cross-Request Leak
    cvelistv5