Skip to content
Fencer Vulns
high 7.5

CVE-2022-26779 json

Apache Cloudstack insecure random number generation affects project email invitation

published 2022-03-15 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-31329

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.

Patch / fix

  • Apache Software Foundation Apache CloudStack 4.16.1

Exploit prediction

2.85% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P

Affected products

  • Apache Software Foundation Apache CloudStack

Classification

Weakness
  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.