Search
Find a vulnerability
Search criteria
2 vulnerabilities found for xen-orchestra by vatesfr
CVE-2026-110111 (GCVE-0-2026-110111)
Vulnerability from nvd – Published: 2026-10-13 19:05 – Updated: 2026-10-13 19:05
VLAI
EPSS
VEX
Title
Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi
Summary
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
Severity
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/vatesfr/xen-orchestra/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/xen-orchestr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vatesfr | xen-orchestra |
Affected:
0 , < 6.9.0
(semver)
Unaffected: 6.9.0 (semver) cpe:2.3:a:xen-orchestra:xen_orchestra_server:*:*:*:*:*:*:*:* |
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/vatesfr/xen-orchestra",
"product": "xen-orchestra",
"repo": "https://github.com/vatesfr/xen-orchestra",
"vendor": "vatesfr",
"versions": [
{
"lessThan": "6.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.9.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xen-orchestra:xen_orchestra_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Allan Victor"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:05:26.615Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mc4m-hc98-rhmv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv"
},
{
"name": "VulnCheck Advisory: Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-privilege-escalation-via-prototype-pollution-in-vm-importfromesxi"
}
],
"title": "Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110111",
"datePublished": "2026-10-13T19:05:26.615Z",
"dateReserved": "2026-10-13T16:22:43.091Z",
"dateUpdated": "2026-10-13T19:05:26.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110111 (GCVE-0-2026-110111)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:05 – Updated: 2026-10-13 19:05
VLAI
EPSS
VEX
Title
Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi
Summary
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
Severity
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/vatesfr/xen-orchestra/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/xen-orchestr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vatesfr | xen-orchestra |
Affected:
0 , < 6.9.0
(semver)
Unaffected: 6.9.0 (semver) cpe:2.3:a:xen-orchestra:xen_orchestra_server:*:*:*:*:*:*:*:* |
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/vatesfr/xen-orchestra",
"product": "xen-orchestra",
"repo": "https://github.com/vatesfr/xen-orchestra",
"vendor": "vatesfr",
"versions": [
{
"lessThan": "6.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.9.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xen-orchestra:xen_orchestra_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Allan Victor"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:05:26.615Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mc4m-hc98-rhmv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv"
},
{
"name": "VulnCheck Advisory: Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-privilege-escalation-via-prototype-pollution-in-vm-importfromesxi"
}
],
"title": "Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110111",
"datePublished": "2026-10-13T19:05:26.615Z",
"dateReserved": "2026-10-13T16:22:43.091Z",
"dateUpdated": "2026-10-13T19:05:26.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}