CVE-2026-61398

Summary

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.

This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache CloudStack4.15.1.0 <= 4.20.3.0affected
Apache Software FoundationApache CloudStack4.21.0.0 <= 4.22.1.0affected

Weaknesses

  • CWE-116: CWE-116 Improper Encoding or Escaping of Output

References