Search
Find a vulnerability
Search criteria
89 vulnerabilities by Cloud Software Group
MOKSHA-2026-0089 (moksha-2026-0089)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Raw kbps Value Exposure in Private Xenstore via VIF.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params:kbps, which xenopsd writes as a raw Int64.to_string value to the VIF private xenstore path at device.ml:920-927. While Int64.to_string prevents path injection, the raw user-controlled rate values are readable by dom0 processes without provenance tracking. Dom0 tools consuming VIF private xenstore data cannot distinguish between system-generated and attacker-supplied values. The field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params:kbps, which xenopsd writes as a raw Int64.to_string value to the VIF private xenstore path at device.ml:920-927. While Int64.to_string prevents path injection, the raw user-controlled rate values are readable by dom0 processes without provenance tracking. Dom0 tools consuming VIF private xenstore data cannot distinguish between system-generated and attacker-supplied values. The field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0089"
}
],
"title": "Raw kbps Value Exposure in Private Xenstore via VIF.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0089"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0089",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0050 (moksha-2026-0050)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
LUNperVDI Mode Manipulation via SR.sm_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt the VDI management mode of a storage repository by adding or removing the LUNperVDI key in SR.sm_config. This key controls whether the SR maps one LUN per VDI or uses shared LUNs with VHD containers. Mode mismatch causes VDI creation, deletion, and scanning failures. The sm_config field has zero map_keys_roles entries and remains writable after SR creation despite being intended as driver-managed metadata.
Severity
5.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt the VDI management mode of a storage repository by adding or removing the LUNperVDI key in SR.sm_config. This key controls whether the SR maps one LUN per VDI or uses shared LUNs with VHD containers. Mode mismatch causes VDI creation, deletion, and scanning failures. The sm_config field has zero map_keys_roles entries and remains writable after SR creation despite being intended as driver-managed metadata."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0050"
}
],
"title": "LUNperVDI Mode Manipulation via SR.sm_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0050"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0050",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0072 (moksha-2026-0072)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
SR Scan Interval Manipulation via Host.other_config auto-scan-interval
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting 0.001 causes continuous SR scanning (CPU/IO exhaustion); setting 999999999 effectively disables scanning (storage state blindness). The field has no map_keys_roles entries for infrastructure keys.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting 0.001 causes continuous SR scanning (CPU/IO exhaustion); setting 999999999 effectively disables scanning (storage state blindness). The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0072"
}
],
"title": "SR Scan Interval Manipulation via Host.other_config auto-scan-interval"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0072"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0072",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0058 (moksha-2026-0058)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Xenstore Quota Exhaustion via VM.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can exhaust a guest domain's xenstore quota by injecting a large number of vm-data/* keys into VM.xenstore_data. Xenstore enforces a per-domain quota shared with guest agent data. When injected data consumes the quota, the guest's own xenstore operations fail, disrupting PV drivers, network configuration, and guest agent communication. The field has zero map_keys_roles entries and no value length limits.
Severity
5.3 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can exhaust a guest domain\u0027s xenstore quota by injecting a large number of vm-data/* keys into VM.xenstore_data. Xenstore enforces a per-domain quota shared with guest agent data. When injected data consumes the quota, the guest\u0027s own xenstore operations fail, disrupting PV drivers, network configuration, and guest agent communication. The field has zero map_keys_roles entries and no value length limits."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0058"
}
],
"title": "Xenstore Quota Exhaustion via VM.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0058"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0058",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0064 (moksha-2026-0064)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Database Field Poisoning via VDI.xenstore_data Arbitrary Keys
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary key-value pairs into VDI.xenstore_data, a field designed for SM backend use. The field has zero map_keys_roles, zero write-time validation, and zero sanitization. Injected data persists in the XAPI database and is visible to all API consumers. Downstream systems (backup tools, inventory scanners, orchestration platforms) may trust the values as SM-generated metadata. The xe CLI reports this field as read-only, but programmatic API access bypasses this restriction.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary key-value pairs into VDI.xenstore_data, a field designed for SM backend use. The field has zero map_keys_roles, zero write-time validation, and zero sanitization. Injected data persists in the XAPI database and is visible to all API consumers. Downstream systems (backup tools, inventory scanners, orchestration platforms) may trust the values as SM-generated metadata. The xe CLI reports this field as read-only, but programmatic API access bypasses this restriction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0064"
}
],
"title": "Database Field Poisoning via VDI.xenstore_data Arbitrary Keys"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0064"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0064",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0048 (moksha-2026-0048)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Availability Disruption via Host.other_config multipathing
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable multipath I/O redundancy on a host by writing multipathing=false to Host.other_config. SM drivers read this key during initialization and switch to single-path I/O. If the single remaining storage path fails, all VMs on that storage become unavailable. The field has no map_keys_roles protection for infrastructure keys, and the degradation produces no warnings or alerts.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable multipath I/O redundancy on a host by writing multipathing=false to Host.other_config. SM drivers read this key during initialization and switch to single-path I/O. If the single remaining storage path fails, all VMs on that storage become unavailable. The field has no map_keys_roles protection for infrastructure keys, and the degradation produces no warnings or alerts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0048"
}
],
"title": "Storage Availability Disruption via Host.other_config multipathing"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0048"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0048",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0054 (moksha-2026-0054)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
MAC Address Collision via VM.other_config mac_seed
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can cause MAC address collisions by setting the mac_seed key in VM.other_config to a value copied from another VM. The MAC generation algorithm in xapi_vif_helpers.ml uses this seed deterministically. Pool-level duplicate detection exists but only runs during pool join and import, not during direct other_config writes. MAC collisions cause network connectivity failures, ARP table corruption, and traffic misdirection.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can cause MAC address collisions by setting the mac_seed key in VM.other_config to a value copied from another VM. The MAC generation algorithm in xapi_vif_helpers.ml uses this seed deterministically. Pool-level duplicate detection exists but only runs during pool join and import, not during direct other_config writes. MAC collisions cause network connectivity failures, ARP table corruption, and traffic misdirection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0054"
}
],
"title": "MAC Address Collision via VM.other_config mac_seed"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0054"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0054",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0045 (moksha-2026-0045)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Arbitrary Bond Property Injection via PIF.other_config bond-*
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties by writing keys with the bond- prefix to PIF.other_config. The nm.ml module extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property override with zero validation on property names or values. This enables bond mode changes, timer manipulation, and injection of invalid parameters causing OVS errors and network disruption.
Severity
6.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties by writing keys with the bond- prefix to PIF.other_config. The nm.ml module extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property override with zero validation on property names or values. This enables bond mode changes, timer manipulation, and injection of invalid parameters causing OVS errors and network disruption."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0045"
}
],
"title": "Arbitrary Bond Property Injection via PIF.other_config bond-*"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0045"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0045",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0028 (moksha-2026-0028)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VDI Lifecycle Corruption via VBD.other_config owner Key
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI's VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI\u0027s VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0028"
}
],
"title": "VDI Lifecycle Corruption via VBD.other_config owner Key"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0028"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0028",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0051 (moksha-2026-0051)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Config Drive Misidentification via VDI.other_config config-drive
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can mark any VDI as a cloud-init config drive by setting config-drive=true in VDI.other_config. The key is defined in xapi_globs.ml as a sync key and consumed during migration and import operations. Guest cloud-init agents misinterpret the flagged VDI's contents as trusted hypervisor-provided metadata, potentially initializing the guest with attacker-controlled configuration.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can mark any VDI as a cloud-init config drive by setting config-drive=true in VDI.other_config. The key is defined in xapi_globs.ml as a sync key and consumed during migration and import operations. Guest cloud-init agents misinterpret the flagged VDI\u0027s contents as trusted hypervisor-provided metadata, potentially initializing the guest with attacker-controlled configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0051"
}
],
"title": "Config Drive Misidentification via VDI.other_config config-drive"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0051"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0051",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0052 (moksha-2026-0052)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Leaked VBD Detection Spoofing via task_id/related_to
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can spoof the task_id and related_to keys in VBD.other_config to evade leaked VBD detection. These keys track which task created a VBD and which control domain it belongs to. By injecting false values, an attacker makes malicious VBDs appear as legitimate control-domain attachments, causing the cleanup subsystem to skip them. VBD.other_config has zero map_keys_roles entries.
Severity
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can spoof the task_id and related_to keys in VBD.other_config to evade leaked VBD detection. These keys track which task created a VBD and which control domain it belongs to. By injecting false values, an attacker makes malicious VBDs appear as legitimate control-domain attachments, causing the cleanup subsystem to skip them. VBD.other_config has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0052"
}
],
"title": "Leaked VBD Detection Spoofing via task_id/related_to"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0052"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0052",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0022 (moksha-2026-0022)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Real-Time I/O Class Abuse via VBD.qos_algorithm_params - Cross-VM Starvation
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can set the real-time I/O scheduling class on VBD kernel threads by writing sched=rt and class=highest to VBD.qos_algorithm_params. xenopsd invokes ionice -c1 -n0 on the affected threads, granting strict priority over all best-effort and idle I/O on the host. This starves I/O for every other VM on the same host. The change takes effect immediately without VBD replug and produces no security alert.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can set the real-time I/O scheduling class on VBD kernel threads by writing sched=rt and class=highest to VBD.qos_algorithm_params. xenopsd invokes ionice -c1 -n0 on the affected threads, granting strict priority over all best-effort and idle I/O on the host. This starves I/O for every other VM on the same host. The change takes effect immediately without VBD replug and produces no security alert."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0022"
}
],
"title": "Real-Time I/O Class Abuse via VBD.qos_algorithm_params - Cross-VM Starvation"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0022"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0022",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0037 (moksha-2026-0037)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VHD Test Mode and Failure Injection via SR.other_config testmode
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can activate VHD failure injection on production storage by setting SR.other_config:testmode to a recognized test mode string. The SM driver matches the value against the ENV_VAR_VHD_TEST dictionary, and matching values cause environment variables to be set that instruct vhd-util to simulate failures during structural VHD operations. The resulting failures leave VHD metadata in an inconsistent state - a targeted data corruption attack indistinguishable from legitimate internal errors.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can activate VHD failure injection on production storage by setting SR.other_config:testmode to a recognized test mode string. The SM driver matches the value against the ENV_VAR_VHD_TEST dictionary, and matching values cause environment variables to be set that instruct vhd-util to simulate failures during structural VHD operations. The resulting failures leave VHD metadata in an inconsistent state - a targeted data corruption attack indistinguishable from legitimate internal errors."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "Active Debug Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0037"
}
],
"title": "VHD Test Mode and Failure Injection via SR.other_config testmode"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0037"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0037",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0008 (moksha-2026-0008)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Driver Domain PBD Detach DoS via VM.other_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD's SR and sets the PBD's currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM's lifecycle.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD\u0027s SR and sets the PBD\u0027s currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM\u0027s lifecycle."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0008"
}
],
"title": "Storage Driver Domain PBD Detach DoS via VM.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0008"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0008",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0025 (moksha-2026-0025)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Protocol Metadata Poisoning via SR.sm_config (targetIQN/target/LUNid)
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt storage protocol metadata by modifying targetIQN, target, datatype, or LUNid keys in SR.sm_config on iSCSI and HBA storage repositories. These keys are written by the SM driver during SR.create and read back during subsequent operations, but the field remains writable after creation. Modifying LUNid causes VDI operations to target the wrong LUN, enabling cross-SR data corruption. This is an SR-level variant of the SMC-1 storage protocol injection vector.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt storage protocol metadata by modifying targetIQN, target, datatype, or LUNid keys in SR.sm_config on iSCSI and HBA storage repositories. These keys are written by the SM driver during SR.create and read back during subsequent operations, but the field remains writable after creation. Modifying LUNid causes VDI operations to target the wrong LUN, enabling cross-SR data corruption. This is an SR-level variant of the SMC-1 storage protocol injection vector."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0025"
}
],
"title": "Storage Protocol Metadata Poisoning via SR.sm_config (targetIQN/target/LUNid)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0025"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0025",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0040 (moksha-2026-0040)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
CHAP Credential Exposure via PBD.device_config
Summary
CHAP authentication credentials for iSCSI storage connections in XAPI-based hypervisors (XenServer, XCP-ng) are stored in PBD.device_config as chapuser (plaintext) and chappassword_secret (XAPI secret reference). Any pool-operator can read the PBD record to obtain the chapuser and secret reference, then call secret.get_value() to resolve the cleartext password. This enables cross-user credential theft. The credentials are also stored in plaintext in the XAPI database on disk, accessible via BOC-1 filesystem read.
Severity
6.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "CHAP authentication credentials for iSCSI storage connections in XAPI-based hypervisors (XenServer, XCP-ng) are stored in PBD.device_config as chapuser (plaintext) and chappassword_secret (XAPI secret reference). Any pool-operator can read the PBD record to obtain the chapuser and secret reference, then call secret.get_value() to resolve the cleartext password. This enables cross-user credential theft. The credentials are also stored in plaintext in the XAPI database on disk, accessible via BOC-1 filesystem read."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0040"
}
],
"title": "CHAP Credential Exposure via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0040"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0040",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0035 (moksha-2026-0035)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. Storage targets using IQN-based ACLs grant access based on the spoofed identity, enabling unauthorized access to LUNs belonging to other hosts or tenants.
Severity
6.8 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host\u0027s iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. Storage targets using IQN-based ACLs grant access based on the spoofed identity, enabling unauthorized access to LUNs belonging to other hosts or tenants."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0035"
}
],
"title": "iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0035"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0035",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0041 (moksha-2026-0041)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Rolling Upgrade State Injection via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a fake rolling upgrade state by writing the rolling_upgrade_in_progress key to Pool.other_config. The mere presence of this key causes helpers.ml to return true, disabling version compatibility checks, altering pool behavior during operations, and preventing detection of version mismatches across the pool. The key has no map_keys_roles protection and no write-time validation.
Severity
6.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a fake rolling upgrade state by writing the rolling_upgrade_in_progress key to Pool.other_config. The mere presence of this key causes helpers.ml to return true, disabling version compatibility checks, altering pool behavior during operations, and preventing detection of version mismatches across the pool. The key has no map_keys_roles protection and no write-time validation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0041"
}
],
"title": "Rolling Upgrade State Injection via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0041"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0041",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0034 (moksha-2026-0034)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Coalesce Blocking via VDI.other_config leaf-coalesce
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0034"
}
],
"title": "Coalesce Blocking via VDI.other_config leaf-coalesce"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0034"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0034",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0057 (moksha-2026-0057)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
FIST Namespace Exposure via VM.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI's actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption.
Severity
5.3 (Medium)
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI\u0027s actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0057"
}
],
"title": "FIST Namespace Exposure via VM.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0057"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0057",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0014 (moksha-2026-0014)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Local Initiator IQN Injection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by injecting an arbitrary IQN via PBD.device_config:localIQN. The SM driver calls iscsilib.set_IQN() which writes the attacker-supplied value to /etc/iscsi/initiatorname.iscsi. All subsequent iSCSI operations from the host use the spoofed IQN, bypassing storage array access controls based on initiator identity. Enterprise storage arrays commonly use IQN-based ACLs as the primary access control mechanism for iSCSI LUNs.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host\u0027s iSCSI initiator identity by injecting an arbitrary IQN via PBD.device_config:localIQN. The SM driver calls iscsilib.set_IQN() which writes the attacker-supplied value to /etc/iscsi/initiatorname.iscsi. All subsequent iSCSI operations from the host use the spoofed IQN, bypassing storage array access controls based on initiator identity. Enterprise storage arrays commonly use IQN-based ACLs as the primary access control mechanism for iSCSI LUNs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0014"
}
],
"title": "Local Initiator IQN Injection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0014"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0014",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0079 (moksha-2026-0079)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Network Sharing Bypass via Network.other_config assume_network_is_shared
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can bypass network locality checks by setting assume_network_is_shared=true in Network.other_config. The key is checked at xapi_network_attach_helpers.ml:132-133. When set, XAPI treats the network as shared across all hosts regardless of actual PIF connectivity, allowing VMs to start on hosts without network infrastructure. This causes VIF attachment failures or silent connectivity loss. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.1 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can bypass network locality checks by setting assume_network_is_shared=true in Network.other_config. The key is checked at xapi_network_attach_helpers.ml:132-133. When set, XAPI treats the network as shared across all hosts regardless of actual PIF connectivity, allowing VMs to start on hosts without network infrastructure. This causes VIF attachment failures or silent connectivity loss. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0079"
}
],
"title": "Network Sharing Bypass via Network.other_config assume_network_is_shared"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0079"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0079",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0047 (moksha-2026-0047)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
DNS Search Domain Injection via PIF.other_config domain
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary DNS search domains into the host resolver configuration by writing to PIF.other_config:domain. The nm.ml module reads this key, splits on commas, and passes the resulting domain list to xcp-networkd with no validation. Injected search domains cause unqualified hostname lookups to resolve through attacker-controlled domains, enabling DNS hijack of internal service discovery.
Severity
6.1 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary DNS search domains into the host resolver configuration by writing to PIF.other_config:domain. The nm.ml module reads this key, splits on commas, and passes the resulting domain list to xcp-networkd with no validation. Injected search domains cause unqualified hostname lookups to resolve through attacker-controlled domains, enabling DNS hijack of internal service discovery."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0047"
}
],
"title": "DNS Search Domain Injection via PIF.other_config domain"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0047"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0047",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0075 (moksha-2026-0075)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Memory Ratio Bounds Relaxation via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can relax memory ratio bounds for all VMs by writing extreme values to Pool.other_config:memory-ratio-hvm and memory-ratio-pv. These keys define the lower bound ratio for memory-dynamic-min relative to memory-static-max (default 0.25). Setting to 0 allows VMs to have near-zero dynamic minimum memory, causing guest OS instability or crashes pool-wide when the balloon driver reclaims memory. No range validation exists. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can relax memory ratio bounds for all VMs by writing extreme values to Pool.other_config:memory-ratio-hvm and memory-ratio-pv. These keys define the lower bound ratio for memory-dynamic-min relative to memory-static-max (default 0.25). Setting to 0 allows VMs to have near-zero dynamic minimum memory, causing guest OS instability or crashes pool-wide when the balloon driver reclaims memory. No range validation exists. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0075"
}
],
"title": "Memory Ratio Bounds Relaxation via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0075"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0075",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0043 (moksha-2026-0043)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
PBD Synchronization Bypass via Pool.other_config sync_create_pbds
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable automatic PBD creation for shared storage repositories by setting sync_create_pbds to nosync in Pool.other_config. The create_storage.ml module checks this value during host boot and skips PBD creation when set, causing shared storage to remain disconnected after reboot. VMs depending on shared storage cannot start. The disruption persists across reboots until the key is manually removed.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable automatic PBD creation for shared storage repositories by setting sync_create_pbds to nosync in Pool.other_config. The create_storage.ml module checks this value during host boot and skips PBD creation when set, causing shared storage to remain disconnected after reboot. VMs depending on shared storage cannot start. The disruption persists across reboots until the key is manually removed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0043"
}
],
"title": "PBD Synchronization Bypass via Pool.other_config sync_create_pbds"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0043"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0043",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0069 (moksha-2026-0069)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Hypervisor Security Feature Manipulation via VM.platform (nx/hap)
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable CPU security features by writing to VM.platform keys. Setting nx=false removes DEP protection, hap=false forces shadow paging, nested-virt=true expands the hypervisor attack surface, and extreme max_grant_frames/max_maptrack_frames values cause resource exhaustion. The field has zero map_keys_roles entries - all security-critical hypervisor keys are writable by the lowest delegated management role.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable CPU security features by writing to VM.platform keys. Setting nx=false removes DEP protection, hap=false forces shadow paging, nested-virt=true expands the hypervisor attack surface, and extreme max_grant_frames/max_maptrack_frames values cause resource exhaustion. The field has zero map_keys_roles entries - all security-critical hypervisor keys are writable by the lowest delegated management role."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0069"
}
],
"title": "Hypervisor Security Feature Manipulation via VM.platform (nx/hap)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0069"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0069",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0053 (moksha-2026-0053)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
MTU Manipulation (0-65535) via VIF.other_config
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set an arbitrary MTU value (0 through 65535) on any VIF by writing the mtu key in VIF.other_config. The value is parsed by int_of_string at xapi_xenops.ml:773 with no range validation and applied via ip link set. Extreme MTU values cause network disruption including packet fragmentation, dropped frames, and connectivity failures.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set an arbitrary MTU value (0 through 65535) on any VIF by writing the mtu key in VIF.other_config. The value is parsed by int_of_string at xapi_xenops.ml:773 with no range validation and applied via ip link set. Extreme MTU values cause network disruption including packet fragmentation, dropped frames, and connectivity failures."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0053"
}
],
"title": "MTU Manipulation (0-65535) via VIF.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0053"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0053",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0049 (moksha-2026-0049)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
HIMN Identity Hijack + DHCP Manipulation via Network.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can hijack the Host Internal Management Network (HIMN) identity or manipulate guest VM DHCP configuration by modifying is_host_internal_management_network, ip_begin, ip_end, and netmask keys in Network.other_config. Marking a second network as HIMN creates identity ambiguity in XAPI's List.find resolution. Modifying the DHCP range enables IP exhaustion attacks or assignment of IPs outside the expected link-local range, disrupting guest agent communication.
Severity
5.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can hijack the Host Internal Management Network (HIMN) identity or manipulate guest VM DHCP configuration by modifying is_host_internal_management_network, ip_begin, ip_end, and netmask keys in Network.other_config. Marking a second network as HIMN creates identity ambiguity in XAPI\u0027s List.find resolution. Modifying the DHCP range enables IP exhaustion attacks or assignment of IPs outside the expected link-local range, disrupting guest agent communication."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0049"
}
],
"title": "HIMN Identity Hijack + DHCP Manipulation via Network.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0049"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0049",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0083 (moksha-2026-0083)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Boot Order Manipulation via VM.HVM_boot_params order
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set an arbitrary boot order string in VM.HVM_boot_params:order. The value is passed verbatim to QEMU as the -boot order argument at device.ml:3957-3958. XAPI performs no validation beyond replacing empty values with the default. QEMU ignores unrecognized characters, limiting impact to forcing PXE network boot when the attacker controls DHCP/PXE infrastructure. The field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set an arbitrary boot order string in VM.HVM_boot_params:order. The value is passed verbatim to QEMU as the -boot order argument at device.ml:3957-3958. XAPI performs no validation beyond replacing empty values with the default. QEMU ignores unrecognized characters, limiting impact to forcing PXE network boot when the attacker controls DHCP/PXE infrastructure. The field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0083"
}
],
"title": "Boot Order Manipulation via VM.HVM_boot_params order"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0083"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0083",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0030 (moksha-2026-0030)
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
XML Injection in Template Provisioning via VM.other_config disks
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject crafted XML into VM.other_config:disks, which is parsed via Xml.parse_string during template provisioning. The parser expects a provision/disk structure and extracts device, size, sr, bootable, and type attributes. Malformed XML causes provisioning denial of service. Well-formed but malicious XML enables SR targeting for VDI creation, storage exhaustion via extreme disk sizes, and resource exhaustion via mass VDI specification. The key has no per-key RBAC protection.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject crafted XML into VM.other_config:disks, which is parsed via Xml.parse_string during template provisioning. The parser expects a provision/disk structure and extracts device, size, sr, bootable, and type attributes. Malformed XML causes provisioning denial of service. Well-formed but malicious XML enables SR targeting for VDI creation, storage exhaustion via extreme disk sizes, and resource exhaustion via mass VDI specification. The key has no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0030"
}
],
"title": "XML Injection in Template Provisioning via VM.other_config disks"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0030"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0030",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}