Issues · apache/cloudstack · GitHub

Labels Milestones New issue

[Security] Apache CloudStack `ApiServlet` logs duplicate sensitive query parameter values in plaintext before authentication

#13311

· YLChen-007 opened

on Jun 1, 2026

[repo-status] Daily Status Report — June 1, 2026

#13310

· github-actions opened

on Jun 1, 2026

[Security] Vulnerability in `Script.java` Command Sanitization Allows Exposure of Plaintext Ceph RBD Storage Credentials in Logs

#13309

· YLChen-007 opened

on Jun 1, 2026

[Security] Plaintext Password Exposure in OVM3 Hypervisor Support Configuration Exception Logging

#13308

· YLChen-007 opened

on Jun 1, 2026

[Security] Plaintext VM User-Data and SSH Public Key Log Exposure in Baremetal Kickstart PXE Plugin

#13307

· YLChen-007 opened

on Jun 1, 2026

[Security] Sensitive Keystore Credentials Exposure in SSHCmdHelper Logs

#13306

· YLChen-007 opened

on Jun 1, 2026

[Security] Sensitive Keystore Credentials and SSL Private Key Plaintext Exposure in KVM Host Agent Logs

#13305

· YLChen-007 opened

on Jun 1, 2026

[Security] Exposure of Sensitive Authentication Credentials in System Logs due to Incomplete Sanitization in StringUtils.cleanString

#13304

· YLChen-007 opened

on Jun 1, 2026

[Security] Sensitive Credential Exposure via Parameter Map Serialization in Physical/Virtual Resource Configurations

#13303

· YLChen-007 opened

on Jun 1, 2026

[Security] VM Snapshot VNC Password Loss Variant leading to Unauthenticated Console Access

#13302

· YLChen-007 opened

on Jun 1, 2026

[Security] Sensitive Password Leak in Async Job Status Update Logging (`updateAsyncJobStatus`)

#13301

· YLChen-007 opened

on Jun 1, 2026

[Security] Plaintext CIFS Storage Credential Leakage in Log Files and Exception Traces

#13300

· YLChen-007 opened

on Jun 1, 2026