---
id: CVE-2026-59780
title: >-
  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
  Apache CloudStack's LDAP authentication plugin while listing LDAP providers.












  LDAP configurations can be listed by any authenticated user with access t…
summary: >-
  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
  Apache CloudStack's LDAP authentication plugin while listing LDAP providers.












  LDAP configurations can be listed by any authenticated user with access t…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
vendor: apache
product: cloudstack
affected:
  - 'cloudstack >= 4.2.0, < 4.20.3.1'
  - 'cloudstack >= 4.21.0.0, < 4.22.1.1'
patched:
  - cloudstack 4.22.1.1
published: '2026-08-21'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:10:00.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59780'
references:
  - url: 'https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc'
    label: security@apache.org
tags:
  - nvd
epss: 0.00595
epssPercentile: 0.48231
ingestedAt: '2026-10-27T18:52:09.891Z'
---

## Overview

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.











LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.

















This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

## Affected

- `cloudstack >= 4.2.0, < 4.20.3.1`
- `cloudstack >= 4.21.0.0, < 4.22.1.1`

## Remediation

Upgrade past the affected range:

- `cloudstack 4.22.1.1`