CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Medium 4.3 Published 21 Aug 2026 Updated 24 Aug 2026

Authenticated attackers can trigger Server-Side Request Forgery during template registration before URL validation, potentially accessing internal resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-61422?

CVE-2026-61422 is a medium-severity server-side request forgery vulnerability in Apache Cloudstack, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.

When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Weakness: CWE-918

Which versions are affected by CVE-2026-61422?

It affects 1 product.

Products include Apache Cloudstack.

How do I fix CVE-2026-61422?

No fix has been published for CVE-2026-61422 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-61422 being exploited?

There is no known exploitation of CVE-2026-61422 in the wild and no public exploit code.

All Apache Cloudstack vulnerabilities

Sources

Also known as GHSA-m6q9-qcp6-22cf.