CVE-2026-68745

published 2026-08-21

CVE-2026-68745: Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML…

Priority P3 52 high 8.1 CVSS 3.1

AV N AC H PR N UI N S U C H I H A H

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.

Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	cloudstack	—	—
apache	cloudstack	>= 4.5.2 < 4.20.3.1	4.20.3.1
apache_software_foundation	apache_cloudstack	4.21.0.0 – 4.22.1.0	—
apache_software_foundation	apache_cloudstack	4.5.2 – 4.20.3.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-347