CVE-2026-59780

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0

Description An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP providers. Any user with access to the 'listLdapConfigurations' API, which is available to all default roles by default, can list LDAP configurations.

Recommendations Upgrade versions 4.2.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.