Affected versions

CVE-2026-23989

All OpenCloud instances below version 4.0.3 and all instances below 5.0.2 are affected. The patched versions are 4.0.3 and 5.0.2.

Security patch available

With the release of the vulnerability today, we are also publishing the patch publicly online. We recommend that you schedule and install the update very immediately to ensure the security of your data.

→ You can find the current patch version in the advisory

Immediate action until the patch is applied

• Disable the public links on your instances if you cannot apply the patch immediately.
• Make the following configuration:
  • Configuration customisation
    • Docker Compose: Edit the docker-compose.yml and set GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT="" (empty string value) in the "environment" section of the "opencloud" container.
    • Kubernetes: Edit the deployment opencloud-api and set name: GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT
      value: "" (empty string)
      in the "env" section of the "spec" of the container "api".
• Verify that the mitigation is active and perform the following test:
  • Create a public link as a test
  • Open the link in a private (no active login) browser tab.
  • You will see an error page with the message "File not found"
• Inform your IT team and relevant stakeholders

Patch installation

• The public patch version is available as of today, 05.02.2026 (can be found in the advisory)
• Plan your maintenance window, ensure your backups, prepare your test/staging environment
• Download the patch version 4.0.3
• Test the patch in your test environment
• Run the patch installation in the production environment
• Verify the successful installation
• Remove the temporary security configuration
• if necessary. the temporary security configuration

For more information, please also take a look at our release notes and read our blog "Vulnerabilities in the code: Why transparency and enterprise licences provide security"