🌟 Apache CloudStack — Daily Status Report
Date: June 6, 2026
🚀 Recent Releases
The security release fixed critical CVEs including unauthenticated command injection in direct download templates and unauthorized cross-tenant access in the Proxmox extension. Great job, security team! 🔐
📬 Active Pull Requests
🔥 Hot PRs (updated today)
| # |
Title |
Author |
Status |
#13363 |
Drain per-host reservation when VM starts on different host |
@Kukunin |
needs review |
#13361 |
KVM: apply rbd_default_data_pool for volumes from templates |
@bhouse-nexthop |
needs review |
#13022 |
NPE fix in listProjectRoles for removed project |
@Tonitzpp |
needs review |
#12991 |
Backup: Veeam KVM integration |
@shwstppr |
in testing |
#12617 |
CLVM enhancements and fixes |
@Pearl1594 |
in testing |
🌱 Major Features in Progress
| # |
Feature |
Author |
#12711 |
🔑 Key Management Service (KMS) |
@vishesh92 |
#13032 |
🌐 Network Extension: Orchestrate external network devices |
@weizhouapache |
#13033 |
🔐 Add Keycloak OAuth provider |
@tazouxme |
#13236 |
📊 Quota resource statement API |
@winterhazel |
#12874 |
Cross-zone template registration for Edge Zones |
@vishesh92 |
✅ Recently Merged
#13320 — Stop role from auto-changing on manual account creation (June 3)
#13210 — Convert snapshot command timeouts (June 1)
#12053 — WebSocket server framework + logs web session (June 2)
#11814 — Extensions: sync & download functionalities (June 2)
🐛 Issues Spotlight
🔒 Security Reports (needs triage)
A batch of 9 security issues was filed by @YLChen-007 on June 5 flagging potential credential/password exposure in logs and exception traces across several components (KVM, OVM3, Baremetal, CIFS, SSH). These deserve prompt attention!
#13311 — ApiServlet logs duplicate sensitive query params
#13308 — Plaintext password exposure in OVM3 logs
#13309 — Script.java command sanitization leak
#13297–#13306 — Multiple credential exposure issues
🐞 Other Recent Issues
#13358 — UI: VNF NIC mapping network dropdown always disabled (PR fix ready: #13359)
#13357 — Snapshot revert of ROOT encrypted volume makes VM non-bootable
#13355 — network_rate column type too small (needs DB migration)
#13313 — Show VM name in backup events
📊 Project Health Snapshot
| Area |
Activity |
| 🖥️ KVM |
Active: CLVM, RBD, Veeam backup, VM migration fixes |
| 🌐 Networking |
Network Extension framework, Keycloak OAuth, VNF UI fixes |
| 💾 Storage |
KMS feature, read-only storage guard, physical size fix |
| 🧰 CI/CD |
Pre-commit workflow improvements by @jbampton |
| 📦 Quota |
Quota balance refactor merged; resource statement API incoming |
| 🔐 Security |
Credential leak issues need triage — 9 open reports |
🎯 Recommended Next Steps for Maintainers
- 🚨 Triage the credential exposure issues from
@YLChen-007 — assign severity and owners
- 👀 Review
#13363 (host reservation drain) and #13361 (RBD pool) — both look well-scoped and ready
- 🧪 Help test
#12617 (CLVM) and #12991 (Veeam backup) which are awaiting validation
- 🔑 Advance
#12711 (KMS) — a high-impact feature that would benefit from more review bandwidth
- 🗂️ Check
#13355 — the network_rate type change needs a DB migration and careful planning
💪 The community is buzzing with activity! A huge shoutout to everyone contributing features, fixes, and reviews. Every PR merged and issue triaged makes CloudStack better for everyone!
Generated automatically on 2026-06-06
Generated by Repo Status · sonnet46 689.8K · ◷
Add this agentic workflows to your repo
To install this agentic workflow, run
gh aw add githubnext/agentics/workflows/repo-status.md@main
🌟 Apache CloudStack — Daily Status Report
Date: June 6, 2026
🚀 Recent Releases
The security release fixed critical CVEs including unauthenticated command injection in direct download templates and unauthorized cross-tenant access in the Proxmox extension. Great job, security team! 🔐
📬 Active Pull Requests
🔥 Hot PRs (updated today)
#13363@Kukunin#13361@bhouse-nexthop#13022listProjectRolesfor removed project@Tonitzpp#12991@shwstppr#12617@Pearl1594🌱 Major Features in Progress
#12711@vishesh92#13032@weizhouapache#13033@tazouxme#13236@winterhazel#12874@vishesh92✅ Recently Merged
#13320— Stop role from auto-changing on manual account creation (June 3)#13210— Convert snapshot command timeouts (June 1)#12053— WebSocket server framework + logs web session (June 2)#11814— Extensions: sync & download functionalities (June 2)🐛 Issues Spotlight
🔒 Security Reports (needs triage)
A batch of 9 security issues was filed by
@YLChen-007on June 5 flagging potential credential/password exposure in logs and exception traces across several components (KVM, OVM3, Baremetal, CIFS, SSH). These deserve prompt attention!#13311— ApiServlet logs duplicate sensitive query params#13308— Plaintext password exposure in OVM3 logs#13309— Script.java command sanitization leak#13297–#13306— Multiple credential exposure issues🐞 Other Recent Issues
#13358— UI: VNF NIC mapping network dropdown always disabled (PR fix ready:#13359)#13357— Snapshot revert of ROOT encrypted volume makes VM non-bootable#13355—network_ratecolumn type too small (needs DB migration)#13313— Show VM name in backup events📊 Project Health Snapshot
@jbampton🎯 Recommended Next Steps for Maintainers
@YLChen-007— assign severity and owners#13363(host reservation drain) and#13361(RBD pool) — both look well-scoped and ready#12617(CLVM) and#12991(Veeam backup) which are awaiting validation#12711(KMS) — a high-impact feature that would benefit from more review bandwidth#13355— thenetwork_ratetype change needs a DB migration and careful planningGenerated automatically on 2026-06-06
Add this agentic workflows to your repo
To install this agentic workflow, run