Executive brief
Apache CloudStack is a cloud management platform that allows administrators to register virtual machine templates and ISO images for deployment. The vulnerability permits an authenticated attacker to trigger HTTP requests to arbitrary URLs before CloudStack validates the destination, potentially probing internal networks or services. Although URL validation does occur before actual file download, the pre-validation HTTP call creates a window for reconnaissance or denial-of-service attacks against the management server.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in CloudStack's template and ISO registration workflow. When an authenticated user registers a template or ISO file, CloudStack performs a live HTTP HEAD/GET request to the specified URL to determine file size for secondary storage quota checks—but this request happens before URL validation is applied. An attacker with valid credentials can supply a malicious URL pointing to internal services, private IP ranges, or localhost, causing the CloudStack management server to make unsolicited requests and potentially leak response headers or service information. Although URL validation occurs later before the Secondary Storage VM performs the actual download, the pre-validation HTTP call remains exploitable for network reconnaissance. Patches are available in versions 4.20.3.1, 4.22.1.1, and later.
Affected products
- Apache CloudStack 4.20.3.0 and 4.21.0.0 through 4.22.1.0
Timeline
- 2026-08-21: disclosed