PT-2026-79321

CVE-2026-59780

Published

2026-08-21

Updated

2026-08-27

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0

Description An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP providers. Any user with access to the 'listLdapConfigurations' API, which is available to all default roles by default, can list LDAP configurations.

Recommendations Upgrade versions 4.2.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Łukasz Bawolski

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers