---
id: CVE-2026-68745
title: >-
  Certificate validation failures in SAML authentication in Apache CloudStack
  4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML
  response to the management server
summary: >-
  Certificate validation failures in SAML authentication in Apache CloudStack
  4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML
  response to the management server. The agent will have to spoof the ip address
  of …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-347
vendor: apache
product: cloudstack
affected:
  - 'cloudstack >= 4.5.2, < 4.20.3.1'
  - cloudstack = 4.22.1.0
patched:
  - cloudstack 4.20.3.1
published: '2026-08-21'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:10:00.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68745'
references:
  - url: 'https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc'
    label: security@apache.org
tags:
  - nvd
epss: 0.00204
epssPercentile: 0.10294
ingestedAt: '2026-10-27T18:52:09.899Z'
---

## Overview

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.

Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.

## Affected

- `cloudstack >= 4.5.2, < 4.20.3.1`
- `cloudstack = 4.22.1.0`

## Remediation

Upgrade past the affected range:

- `cloudstack 4.20.3.1`