CVE-2026-68745

HighCVSS 8.1/10Last modified Oct 16, 2026

Description

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.

Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2026
Last modified
Oct 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-687468.8Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access CVE-2026-687476.1Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrreCVE-2026-687497.5Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attaCVE-2026-68759.5ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could eCVE-2026-687507.5Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attackeCVE-2026-687527.2A Project Resource Manager may gain broader administrative privileges under specific conditions.CVE-2026-687535.3An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.CVE-2026-687546.5A repository publisher without delete permission may modify protected package content under specific conditions.CVE-2026-687554.3A bundle writer may create misleading release promotion information under specific conditions.CVE-2026-687566.6A party with write access to stored session data may affect JFrog Artifactory under specific conditions.CVE-2026-687577.5A user with access to a valid SAML response may impersonate another user under specific conditions.CVE-2026-687586.5A low-privileged authenticated user may access restricted support information under specific conditions.