Search
Find a vulnerability
Search criteria
89 vulnerabilities found for XenServer by Cloud Software Group
MOKSHA-2026-0005 (moksha-2026-0005)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
NFS Server Redirection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can create an NFS SR with attacker-controlled server and serverpath values in PBD.device_config. The SM driver passes these values directly to mount.nfs without validation. The hypervisor mounts the attacker's NFS export as a storage repository, serving all VMs on that SR from attacker-controlled storage. The attacker controls all VM disk images, can inject malware into any VM, and exfiltrate all data written to the SR.
Severity
9.1 (Critical)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can create an NFS SR with attacker-controlled server and serverpath values in PBD.device_config. The SM driver passes these values directly to mount.nfs without validation. The hypervisor mounts the attacker\u0027s NFS export as a storage repository, serving all VMs on that SR from attacker-controlled storage. The attacker controls all VM disk images, can inject malware into any VM, and exfiltrate all data written to the SR."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0005"
}
],
"title": "NFS Server Redirection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0005"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0005",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0070 (moksha-2026-0070)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Infrastructure Metadata Leak via SR-IOV VIF Xenstore Passthrough
Summary
On XAPI-based hypervisors (XenServer, XCP-ng), arbitrary keys in VIF.other_config become visible to the guest VM via xenstore when the VIF is backed by an SR-IOV virtual function. The standard VIF path applies a 7-key whitelist filter (device.ml:827-829); the SR-IOV path (device.ml:978-1006) omits this filter entirely. Unfiltered keys are written to a guest-readable xenstore path (rwperm_for_guest). Infrastructure metadata written to other_config by administrators or automation tools is exposed to the guest, violating the assumption that other_config is host-internal.
Severity
5.0 (Medium)
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "On XAPI-based hypervisors (XenServer, XCP-ng), arbitrary keys in VIF.other_config become visible to the guest VM via xenstore when the VIF is backed by an SR-IOV virtual function. The standard VIF path applies a 7-key whitelist filter (device.ml:827-829); the SR-IOV path (device.ml:978-1006) omits this filter entirely. Unfiltered keys are written to a guest-readable xenstore path (rwperm_for_guest). Infrastructure metadata written to other_config by administrators or automation tools is exposed to the guest, violating the assumption that other_config is host-internal."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0070"
}
],
"title": "Infrastructure Metadata Leak via SR-IOV VIF Xenstore Passthrough"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0070"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0070",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0015 (moksha-2026-0015)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VHD Format Flag Corruption via SR.sm_config use_vhd
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause complete data loss for all VDIs on an LVHD storage repository by removing the use_vhd key from SR.sm_config. This key determines whether the LVHDSR driver operates in VHD format or raw LV mode. Removing it causes the driver to fall back to raw LV mode on the next PBD plug cycle. VHD-format VDIs accessed in raw mode produce garbage data, and raw-mode writes corrupt VHD metadata structures, resulting in unrecoverable data loss for every VDI on the affected SR.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause complete data loss for all VDIs on an LVHD storage repository by removing the use_vhd key from SR.sm_config. This key determines whether the LVHDSR driver operates in VHD format or raw LV mode. Removing it causes the driver to fall back to raw LV mode on the next PBD plug cycle. VHD-format VDIs accessed in raw mode produce garbage data, and raw-mode writes corrupt VHD metadata structures, resulting in unrecoverable data loss for every VDI on the affected SR."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0015"
}
],
"title": "VHD Format Flag Corruption via SR.sm_config use_vhd"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0015"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0015",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0019 (moksha-2026-0019)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Tapdisk Memory Pool Injection via VDI.other_config mem-pool
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary mem-pool value into VDI.other_config that flows unsanitized to tapdisk - a root-level storage I/O daemon - via xenstore. The SM driver reads other_config mem-pool in blktap2.py without any sanitization and writes it to xenstore as a tapdisk parameter. Tapdisk runs as root and reads the unsanitized pool name from xenstore to configure its memory allocation behavior. This creates a direct injection path from a low-privilege API user into a root-level service configuration.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary mem-pool value into VDI.other_config that flows unsanitized to tapdisk - a root-level storage I/O daemon - via xenstore. The SM driver reads other_config mem-pool in blktap2.py without any sanitization and writes it to xenstore as a tapdisk parameter. Tapdisk runs as root and reads the unsanitized pool name from xenstore to configure its memory allocation behavior. This creates a direct injection path from a low-privilege API user into a root-level service configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0019"
}
],
"title": "Tapdisk Memory Pool Injection via VDI.other_config mem-pool"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0019"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0019",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0007 (moksha-2026-0007)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Backend-Kind I/O Driver Type Confusion via VBD.other_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can change the storage I/O backend driver for any VBD by writing to VBD.other_config:backend-kind. This key selects whether kernel blkback or userspace tapdisk handles I/O. An attacker can force a VBD to use an unexpected backend, bypassing tapdisk-level access controls, monitoring, and VHD chain processing. The key has no per-key RBAC protection and accepts arbitrary values.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can change the storage I/O backend driver for any VBD by writing to VBD.other_config:backend-kind. This key selects whether kernel blkback or userspace tapdisk handles I/O. An attacker can force a VBD to use an unexpected backend, bypassing tapdisk-level access controls, monitoring, and VHD chain processing. The key has no per-key RBAC protection and accepts arbitrary values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0007"
}
],
"title": "Backend-Kind I/O Driver Type Confusion via VBD.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0007"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0007",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0065 (moksha-2026-0065)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
SCSI Identity Forgery in XAPI Database via VDI.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject forged SCSI INQUIRY data (device ID page 0x83, serial number page 0x80) into VDI.xenstore_data. These keys are normally SM-generated but the field has zero key validation and zero RBAC. Forged SCSI identities persist in the XAPI database and propagate through snapshot, clone, and pool join operations. Downstream systems (backup tools, Windows guest drivers, inventory scanners) that rely on SCSI identity metadata for disk identification may misidentify disks.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject forged SCSI INQUIRY data (device ID page 0x83, serial number page 0x80) into VDI.xenstore_data. These keys are normally SM-generated but the field has zero key validation and zero RBAC. Forged SCSI identities persist in the XAPI database and propagate through snapshot, clone, and pool join operations. Downstream systems (backup tools, Windows guest drivers, inventory scanners) that rely on SCSI identity metadata for disk identification may misidentify disks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0065"
}
],
"title": "SCSI Identity Forgery in XAPI Database via VDI.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0065"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0065",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0002 (moksha-2026-0002)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Protocol Injection via sm_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can write arbitrary key-value pairs to VDI.sm_config and SR.sm_config. These fields store internal storage driver state including VHD chain metadata, GC control flags, and encryption key hashes. XAPI performs zero validation and never notifies the storage backend. SM drivers consume the attacker's data as authoritative internal state, turning the hypervisor into a silent proxy that forwards corrupted commands to the storage subsystem through the trusted management channel. Seven exploitation scenarios are confirmed with live evidence including VHD chain severance, SR-wide crash, GC misdirection, and storage saturation.
Severity
9.9 (Critical)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can write arbitrary key-value pairs to VDI.sm_config and SR.sm_config. These fields store internal storage driver state including VHD chain metadata, GC control flags, and encryption key hashes. XAPI performs zero validation and never notifies the storage backend. SM drivers consume the attacker\u0027s data as authoritative internal state, turning the hypervisor into a silent proxy that forwards corrupted commands to the storage subsystem through the trusted management channel. Seven exploitation scenarios are confirmed with live evidence including VHD chain severance, SR-wide crash, GC misdirection, and storage saturation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://gna.moksha.dk/MOKSHA-2026-0002"
}
],
"title": "Storage Protocol Injection via sm_config",
"x_moksha_patch_status": {
"blocked_tools": [
"xe CLI only"
],
"bypassed_methods": [
"VDI.add_to_sm_config",
"VDI.set_sm_config",
"SR.add_to_sm_config",
"SR.set_sm_config"
],
"unaffected_tools": [
"XenOrchestra",
"Python XenAPI bindings",
"any XMLRPC client"
],
"xsa489_detail": "SMC-1 was never listed as a fixed vulnerability in XSA-489. XSA-489 incidentally marked sm-config as read-only in the xe CLI, but the XMLRPC API bypasses this CLI restriction entirely. SMC-1 remains fully exploitable via direct API calls. Verified 2026-05-18.",
"xsa489_status": "not_fixed"
}
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0002"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0002",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"vulnId": "GCVE-117-2026-0002",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned.",
"x_moksha_semantic_id": "SMC-1"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [
{
"destId": "MOKSHA-2026-0002",
"type": "equal"
}
],
"vulnId": "GCVE-117-2026-0002"
}
]
}
MOKSHA-2026-0078 (moksha-2026-0078)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Guest Clock Manipulation via VDI.other_config timeoffset
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the guest VM's RTC clock by setting the timeoffset key in VDI.other_config. When a VDI has on_boot=reset, the VDI-level timeoffset overrides the VM platform setting during domain creation (xapi_xenops.ml:312-327). No type validation enforces the expected integer format - arbitrary strings are accepted. Corrupted guest clock affects Windows license validation, certificate expiration, Kerberos authentication, and audit trail integrity. The field has no map_keys_roles entries for infrastructure keys.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the guest VM\u0027s RTC clock by setting the timeoffset key in VDI.other_config. When a VDI has on_boot=reset, the VDI-level timeoffset overrides the VM platform setting during domain creation (xapi_xenops.ml:312-327). No type validation enforces the expected integer format - arbitrary strings are accepted. Corrupted guest clock affects Windows license validation, certificate expiration, Kerberos authentication, and audit trail integrity. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0078"
}
],
"title": "Guest Clock Manipulation via VDI.other_config timeoffset"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0078"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0078",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0001 (moksha-2026-0001)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Arbitrary Host Device Mount via VBD.other_config backend-local
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can mount any host block device as a guest virtual disk by writing an arbitrary filesystem path to VBD.other_config:backend-local. The attack requires a single API call, no exploit code, and produces no security alerts. The vulnerability collapses the entire XAPI RBAC hierarchy, granting root-equivalent access to the hypervisor host, cross-VM data exfiltration, credential theft, SSH backdoor injection, and lateral movement across shared storage.
Severity
9.9 (Critical)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can mount any host block device as a guest virtual disk by writing an arbitrary filesystem path to VBD.other_config:backend-local. The attack requires a single API call, no exploit code, and produces no security alerts. The vulnerability collapses the entire XAPI RBAC hierarchy, granting root-equivalent access to the hypervisor host, cross-VM data exfiltration, credential theft, SSH backdoor injection, and lateral movement across shared storage."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0001"
}
],
"title": "Arbitrary Host Device Mount via VBD.other_config backend-local"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0001"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0001",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0074 (moksha-2026-0074)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
GC and Coalesce Disablement via SR.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable garbage collection and VHD coalescing on any SR by setting gc=false and/or coalesce=false in SR.other_config. The SM garbage collector reads these keys at cleanup.py:2052 and cleanup.py:2090. When disabled, orphan VDIs accumulate consuming storage, and VHD chains grow unbounded degrading I/O performance until chain-length errors occur. The disablement is silent - no alert, no log, no expiration. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable garbage collection and VHD coalescing on any SR by setting gc=false and/or coalesce=false in SR.other_config. The SM garbage collector reads these keys at cleanup.py:2052 and cleanup.py:2090. When disabled, orphan VDIs accumulate consuming storage, and VHD chains grow unbounded degrading I/O performance until chain-length errors occur. The disablement is silent - no alert, no log, no expiration. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0074"
}
],
"title": "GC and Coalesce Disablement via SR.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0074"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0074",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0006 (moksha-2026-0006)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Migration Redirection via VDI.other_config maps_to
Summary
The maps_to key in VDI.other_config in XAPI-based hypervisors (XenServer, XCP-ng) is used during cross-pool migration to map local VDIs to remote destinations. An attacker with root access (via BOC-1) can modify maps_to in the XAPI database mid-migration, redirecting disk operations to an attacker-controlled VDI. The import code reads the modified value via Ref.of_string() with no validation, enabling cross-tenant data exfiltration and data corruption during live migration.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "The maps_to key in VDI.other_config in XAPI-based hypervisors (XenServer, XCP-ng) is used during cross-pool migration to map local VDIs to remote destinations. An attacker with root access (via BOC-1) can modify maps_to in the XAPI database mid-migration, redirecting disk operations to an attacker-controlled VDI. The import code reads the modified value via Ref.of_string() with no validation, enabling cross-tenant data exfiltration and data corruption during live migration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0006"
}
],
"title": "Storage Migration Redirection via VDI.other_config maps_to"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0006"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0006",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0057 (moksha-2026-0057)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
FIST Namespace Exposure via VM.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI's actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption.
Severity
5.3 (Medium)
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI\u0027s actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0057"
}
],
"title": "FIST Namespace Exposure via VM.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0057"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0057",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0010 (moksha-2026-0010)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Block Device Path Injection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. A systemroot check protects the host root device, but does not protect other partitions, additional disks, remote block devices, or other VMs' local storage. Data destruction on arbitrary accessible block devices results.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. A systemroot check protects the host root device, but does not protect other partitions, additional disks, remote block devices, or other VMs\u0027 local storage. Data destruction on arbitrary accessible block devices results."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:L/SI:L/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0010"
}
],
"title": "Block Device Path Injection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0010"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0010",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0032 (moksha-2026-0032)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Bidirectional Data Exfiltration via VM.xenstore_data Guest-to-XAPI-DB Sync
Summary
The VM.xenstore_data field in XAPI-based hypervisors (XenServer, XCP-ng) creates a bidirectional data channel between guest domains and the XAPI management database. Guest writes to vm-data/ in xenstore are read by xenopsd during periodic state synchronization and propagated into VM.xenstore_data in the XAPI database. This is the only confirmed path where a guest domain can inject data into the XAPI database without API authentication. Any API consumer reading VM.xenstore_data receives attacker-injected values.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "The VM.xenstore_data field in XAPI-based hypervisors (XenServer, XCP-ng) creates a bidirectional data channel between guest domains and the XAPI management database. Guest writes to vm-data/ in xenstore are read by xenopsd during periodic state synchronization and propagated into VM.xenstore_data in the XAPI database. This is the only confirmed path where a guest domain can inject data into the XAPI database without API authentication. Any API consumer reading VM.xenstore_data receives attacker-injected values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0032"
}
],
"title": "Bidirectional Data Exfiltration via VM.xenstore_data Guest-to-XAPI-DB Sync"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0032"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0032",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0076 (moksha-2026-0076)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Network Offload Disablement via PIF.other_config ethtool Keys
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC hardware offload features on any physical interface by writing ethtool-gro=off, ethtool-tso=off, etc. to PIF.other_config. These keys are consumed at nm.ml:45-110 and applied via xcp-networkd. Disabling offloads forces software packet processing, degrading performance for all VMs and management traffic. The ethtool-gro key overrides the PIF.properties:gro first-class field via a backward compatibility path. PIF.other_config has zero map_keys_roles entries and highest merge precedence in the other_config chain.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC hardware offload features on any physical interface by writing ethtool-gro=off, ethtool-tso=off, etc. to PIF.other_config. These keys are consumed at nm.ml:45-110 and applied via xcp-networkd. Disabling offloads forces software packet processing, degrading performance for all VMs and management traffic. The ethtool-gro key overrides the PIF.properties:gro first-class field via a backward compatibility path. PIF.other_config has zero map_keys_roles entries and highest merge precedence in the other_config chain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0076"
}
],
"title": "Network Offload Disablement via PIF.other_config ethtool Keys"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0076"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0076",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0034 (moksha-2026-0034)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Coalesce Blocking via VDI.other_config leaf-coalesce
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0034"
}
],
"title": "Coalesce Blocking via VDI.other_config leaf-coalesce"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0034"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0034",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0052 (moksha-2026-0052)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Leaked VBD Detection Spoofing via task_id/related_to
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can spoof the task_id and related_to keys in VBD.other_config to evade leaked VBD detection. These keys track which task created a VBD and which control domain it belongs to. By injecting false values, an attacker makes malicious VBDs appear as legitimate control-domain attachments, causing the cleanup subsystem to skip them. VBD.other_config has zero map_keys_roles entries.
Severity
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can spoof the task_id and related_to keys in VBD.other_config to evade leaked VBD detection. These keys track which task created a VBD and which control domain it belongs to. By injecting false values, an attacker makes malicious VBDs appear as legitimate control-domain attachments, causing the cleanup subsystem to skip them. VBD.other_config has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0052"
}
],
"title": "Leaked VBD Detection Spoofing via task_id/related_to"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0052"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0052",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0029 (moksha-2026-0029)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
SR-IOV VIF Whitelist Bypass via VIF.other_config
Summary
On SR-IOV-backed VIFs in XAPI-based hypervisors (XenServer, XCP-ng), all VIF.other_config keys bypass the whitelist filter and are written unfiltered to guest-readable xenstore. The standard VIF path (Device.Vif.add) applies a 7-key whitelist; the SR-IOV path (Device.NetSriovVf.add) does not apply this filter. This breaks security equivalence between standard and SR-IOV VIFs, allowing a vm-admin to inject arbitrary key-value pairs into guest-readable xenstore on SR-IOV networks.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "On SR-IOV-backed VIFs in XAPI-based hypervisors (XenServer, XCP-ng), all VIF.other_config keys bypass the whitelist filter and are written unfiltered to guest-readable xenstore. The standard VIF path (Device.Vif.add) applies a 7-key whitelist; the SR-IOV path (Device.NetSriovVf.add) does not apply this filter. This breaks security equivalence between standard and SR-IOV VIFs, allowing a vm-admin to inject arbitrary key-value pairs into guest-readable xenstore on SR-IOV networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0029"
}
],
"title": "SR-IOV VIF Whitelist Bypass via VIF.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0029"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0029",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0069 (moksha-2026-0069)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Hypervisor Security Feature Manipulation via VM.platform (nx/hap)
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable CPU security features by writing to VM.platform keys. Setting nx=false removes DEP protection, hap=false forces shadow paging, nested-virt=true expands the hypervisor attack surface, and extreme max_grant_frames/max_maptrack_frames values cause resource exhaustion. The field has zero map_keys_roles entries - all security-critical hypervisor keys are writable by the lowest delegated management role.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable CPU security features by writing to VM.platform keys. Setting nx=false removes DEP protection, hap=false forces shadow paging, nested-virt=true expands the hypervisor attack surface, and extreme max_grant_frames/max_maptrack_frames values cause resource exhaustion. The field has zero map_keys_roles entries - all security-critical hypervisor keys are writable by the lowest delegated management role."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0069"
}
],
"title": "Hypervisor Security Feature Manipulation via VM.platform (nx/hap)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0069"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0069",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0035 (moksha-2026-0035)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. Storage targets using IQN-based ACLs grant access based on the spoofed identity, enabling unauthorized access to LUNs belonging to other hosts or tenants.
Severity
6.8 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host\u0027s iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. Storage targets using IQN-based ACLs grant access based on the spoofed identity, enabling unauthorized access to LUNs belonging to other hosts or tenants."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0035"
}
],
"title": "iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0035"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0035",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0014 (moksha-2026-0014)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Local Initiator IQN Injection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by injecting an arbitrary IQN via PBD.device_config:localIQN. The SM driver calls iscsilib.set_IQN() which writes the attacker-supplied value to /etc/iscsi/initiatorname.iscsi. All subsequent iSCSI operations from the host use the spoofed IQN, bypassing storage array access controls based on initiator identity. Enterprise storage arrays commonly use IQN-based ACLs as the primary access control mechanism for iSCSI LUNs.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host\u0027s iSCSI initiator identity by injecting an arbitrary IQN via PBD.device_config:localIQN. The SM driver calls iscsilib.set_IQN() which writes the attacker-supplied value to /etc/iscsi/initiatorname.iscsi. All subsequent iSCSI operations from the host use the spoofed IQN, bypassing storage array access controls based on initiator identity. Enterprise storage arrays commonly use IQN-based ACLs as the primary access control mechanism for iSCSI LUNs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0014"
}
],
"title": "Local Initiator IQN Injection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0014"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0014",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0008 (moksha-2026-0008)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Driver Domain PBD Detach DoS via VM.other_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD's SR and sets the PBD's currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM's lifecycle.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD\u0027s SR and sets the PBD\u0027s currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM\u0027s lifecycle."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0008"
}
],
"title": "Storage Driver Domain PBD Detach DoS via VM.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0008"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0008",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0013 (moksha-2026-0013)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Pool-Wide OVS Fail-Mode Denial of Service via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network outage across every host in the pool by setting Pool.other_config:vswitch-controller-fail-mode to secure. This pool-level key serves as the default fail mode for every OVS bridge without a per-network override. Without an SDN controller - the common deployment case - all network traffic is dropped on all bridges across all hosts pool-wide, affecting every VM, management connection, and storage path in the pool.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network outage across every host in the pool by setting Pool.other_config:vswitch-controller-fail-mode to secure. This pool-level key serves as the default fail mode for every OVS bridge without a per-network override. Without an SDN controller - the common deployment case - all network traffic is dropped on all bridges across all hosts pool-wide, affecting every VM, management connection, and storage path in the pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0013"
}
],
"title": "Pool-Wide OVS Fail-Mode Denial of Service via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0013"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0013",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0061 (moksha-2026-0061)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
I/O Scheduling Downgrade to Idle Class via VBD.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can downgrade a target VM's I/O scheduling class to idle by setting sched=idle in VBD.qos_algorithm_params. The idle class causes the kernel to service VBD kernel threads only when no other I/O is pending. Under any host I/O load, the target VM experiences severe I/O starvation. The field has zero map_keys_roles entries, and QoS changes take effect immediately via hot-apply without VBD replug.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can downgrade a target VM\u0027s I/O scheduling class to idle by setting sched=idle in VBD.qos_algorithm_params. The idle class causes the kernel to service VBD kernel threads only when no other I/O is pending. Under any host I/O load, the target VM experiences severe I/O starvation. The field has zero map_keys_roles entries, and QoS changes take effect immediately via hot-apply without VBD replug."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0061"
}
],
"title": "I/O Scheduling Downgrade to Idle Class via VBD.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0061"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0061",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0063 (moksha-2026-0063)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Negative kbps Injection in VIF.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject negative kbps values into VIF.qos_algorithm_params. XAPI parses via Int64.of_string without sign validation. xenopsd computes a negative bytes_per_interval which fails the >0L bounds check, silently dropping the rate limit. The XAPI database shows the negative value as the configured rate while no rate is enforced in xenstore, creating an observability gap for administrators and monitoring tools.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject negative kbps values into VIF.qos_algorithm_params. XAPI parses via Int64.of_string without sign validation. xenopsd computes a negative bytes_per_interval which fails the \u003e0L bounds check, silently dropping the rate limit. The XAPI database shows the negative value as the configured rate while no rate is enforced in xenstore, creating an observability gap for administrators and monitoring tools."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0063"
}
],
"title": "Negative kbps Injection in VIF.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0063"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0063",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0077 (moksha-2026-0077)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VIF NIC Offload Disablement via VIF.other_config ethtool Keys
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC offload features (TSO, GSO, etc.) on VIF backend devices by setting ethtool-tso=off and similar keys in VIF.other_config. The VIF hotplug script (vif-real:85-97) executes ethtool -K to disable offloads. This forces host CPU to perform software segmentation, increasing CPU utilization and degrading performance for co-located VMs. VIF.other_config has zero map_keys_roles entries - all ethtool keys are writable by vm-admin.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC offload features (TSO, GSO, etc.) on VIF backend devices by setting ethtool-tso=off and similar keys in VIF.other_config. The VIF hotplug script (vif-real:85-97) executes ethtool -K to disable offloads. This forces host CPU to perform software segmentation, increasing CPU utilization and degrading performance for co-located VMs. VIF.other_config has zero map_keys_roles entries - all ethtool keys are writable by vm-admin."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0077"
}
],
"title": "VIF NIC Offload Disablement via VIF.other_config ethtool Keys"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0077"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0077",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0046 (moksha-2026-0046)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
MTU Manipulation / Network Partition via PIF.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause network partition by setting the mtu key in PIF.other_config to an extreme value. The nm.ml module parses the value with int_of_string and applies it as the interface MTU with no range validation. Setting MTU too low on the management interface causes packet drops that partition the host from the pool. On HA-enabled pools, management network partitioning triggers HA fencing.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause network partition by setting the mtu key in PIF.other_config to an extreme value. The nm.ml module parses the value with int_of_string and applies it as the interface MTU with no range validation. Setting MTU too low on the management interface causes packet drops that partition the host from the pool. On HA-enabled pools, management network partitioning triggers HA fencing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0046"
}
],
"title": "MTU Manipulation / Network Partition via PIF.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0046"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0046",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0023 (moksha-2026-0023)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Guest Agent Script Execution Enablement via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can enable execution of arbitrary scripts within guest VMs by setting Pool.other_config:allow_guest_agent_run_script to true. This enables the guest agent run-script capability pool-wide, allowing the operator to execute commands inside any VM with the guest agent installed. This is a privilege escalation from host-level management to guest-level code execution. The key has no per-key RBAC protection and no write-time validation.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can enable execution of arbitrary scripts within guest VMs by setting Pool.other_config:allow_guest_agent_run_script to true. This enables the guest agent run-script capability pool-wide, allowing the operator to execute commands inside any VM with the guest agent installed. This is a privilege escalation from host-level management to guest-level code execution. The key has no per-key RBAC protection and no write-time validation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0023"
}
],
"title": "Guest Agent Script Execution Enablement via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0023"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0023",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0075 (moksha-2026-0075)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Memory Ratio Bounds Relaxation via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can relax memory ratio bounds for all VMs by writing extreme values to Pool.other_config:memory-ratio-hvm and memory-ratio-pv. These keys define the lower bound ratio for memory-dynamic-min relative to memory-static-max (default 0.25). Setting to 0 allows VMs to have near-zero dynamic minimum memory, causing guest OS instability or crashes pool-wide when the balloon driver reclaims memory. No range validation exists. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can relax memory ratio bounds for all VMs by writing extreme values to Pool.other_config:memory-ratio-hvm and memory-ratio-pv. These keys define the lower bound ratio for memory-dynamic-min relative to memory-static-max (default 0.25). Setting to 0 allows VMs to have near-zero dynamic minimum memory, causing guest OS instability or crashes pool-wide when the balloon driver reclaims memory. No range validation exists. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0075"
}
],
"title": "Memory Ratio Bounds Relaxation via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0075"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0075",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0072 (moksha-2026-0072)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
SR Scan Interval Manipulation via Host.other_config auto-scan-interval
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting 0.001 causes continuous SR scanning (CPU/IO exhaustion); setting 999999999 effectively disables scanning (storage state blindness). The field has no map_keys_roles entries for infrastructure keys.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting 0.001 causes continuous SR scanning (CPU/IO exhaustion); setting 999999999 effectively disables scanning (storage state blindness). The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0072"
}
],
"title": "SR Scan Interval Manipulation via Host.other_config auto-scan-interval"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0072"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0072",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}