Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP
Summary
| CVE | CVE-2026-68745 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-21 09:16:40 UTC |
| Updated | 2026-08-21 09:16:40 UTC |
| Description | Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures. Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue. |
Risk And Classification
EPSS: 0.000750000 probability, percentile 0.000940000 (date 2026-08-21)
Problem Types: CWE-347 | CWE-347 CWE-347 Improper Verification of Cryptographic Signature
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache CloudStack | affected 4.5.2 4.20.3.0 semver | Not specified |
| CNA | Apache Software Foundation | Apache CloudStack | affected 4.21.0.0 4.22.1.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Katriel Moses <[email protected]> (en)
There are currently no legacy QID mappings associated with this CVE.