Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
89 vulnerabilities found for XCP-ng by Vates
MOKSHA-2026-0016
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
PVinPVH Xen Kernel Command-Line Injection via VM.platform
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary Xen hypervisor boot parameters into the PVinPVH xen-shim kernel command line by setting VM.platform:pvinpvh-xen-cmdline to an attacker-controlled string. xenopsd reads this value with zero validation and passes it directly to xenguesthelper. The attacker can disable speculative execution mitigations (spec-ctrl=no), remove Meltdown protection (xpti=false), disable L1TF mitigation (pv-l1tf=false), and disable DMA protection (iommu=no) for the affected PVinPVH domain.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary Xen hypervisor boot parameters into the PVinPVH xen-shim kernel command line by setting VM.platform:pvinpvh-xen-cmdline to an attacker-controlled string. xenopsd reads this value with zero validation and passes it directly to xenguesthelper. The attacker can disable speculative execution mitigations (spec-ctrl=no), remove Meltdown protection (xpti=false), disable L1TF mitigation (pv-l1tf=false), and disable DMA protection (iommu=no) for the affected PVinPVH domain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0016"
}
],
"title": "PVinPVH Xen Kernel Command-Line Injection via VM.platform"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0016"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0016",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0038
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Provisioning Type Manipulation via SR.sm_config allocation
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt storage provisioning behavior by modifying or removing the allocation key in SR.sm_config after SR creation. The key controls whether LVHD SRs use thin or thick provisioning. Changing allocation from thin to thick causes new VDIs to pre-allocate full LV size instead of thin-provisioning. On overcommitted SRs, this causes immediate storage exhaustion. Restoring the key does not shrink already-inflated LVs - recovery requires storage migration.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt storage provisioning behavior by modifying or removing the allocation key in SR.sm_config after SR creation. The key controls whether LVHD SRs use thin or thick provisioning. Changing allocation from thin to thick causes new VDIs to pre-allocate full LV size instead of thin-provisioning. On overcommitted SRs, this causes immediate storage exhaustion. Restoring the key does not shrink already-inflated LVs - recovery requires storage migration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0038"
}
],
"title": "Provisioning Type Manipulation via SR.sm_config allocation"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0038"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0038",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0079
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Network Sharing Bypass via Network.other_config assume_network_is_shared
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can bypass network locality checks by setting assume_network_is_shared=true in Network.other_config. The key is checked at xapi_network_attach_helpers.ml:132-133. When set, XAPI treats the network as shared across all hosts regardless of actual PIF connectivity, allowing VMs to start on hosts without network infrastructure. This causes VIF attachment failures or silent connectivity loss. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.1 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can bypass network locality checks by setting assume_network_is_shared=true in Network.other_config. The key is checked at xapi_network_attach_helpers.ml:132-133. When set, XAPI treats the network as shared across all hosts regardless of actual PIF connectivity, allowing VMs to start on hosts without network infrastructure. This causes VIF attachment failures or silent connectivity loss. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0079"
}
],
"title": "Network Sharing Bypass via Network.other_config assume_network_is_shared"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0079"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0079",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0066
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Metadata Propagation via VDI Snapshot and Clone Operations
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can poison VDI.xenstore_data before a snapshot or clone operation, causing malicious data to propagate to all descendant VDI records. The snapshot/clone code at xapi_vdi.ml:861-862 copies the parent xenstore_data to the new VDI without re-validation. A single injection fans out through the entire hierarchy. The propagation is permanent - removing the injection from the parent does not clean existing descendants.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can poison VDI.xenstore_data before a snapshot or clone operation, causing malicious data to propagate to all descendant VDI records. The snapshot/clone code at xapi_vdi.ml:861-862 copies the parent xenstore_data to the new VDI without re-validation. A single injection fans out through the entire hierarchy. The propagation is permanent - removing the injection from the parent does not clean existing descendants."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0066"
}
],
"title": "Metadata Propagation via VDI Snapshot and Clone Operations"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0066"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0066",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0007
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Backend-Kind I/O Driver Type Confusion via VBD.other_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can change the storage I/O backend driver for any VBD by writing to VBD.other_config:backend-kind. This key selects whether kernel blkback or userspace tapdisk handles I/O. An attacker can force a VBD to use an unexpected backend, bypassing tapdisk-level access controls, monitoring, and VHD chain processing. The key has no per-key RBAC protection and accepts arbitrary values.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can change the storage I/O backend driver for any VBD by writing to VBD.other_config:backend-kind. This key selects whether kernel blkback or userspace tapdisk handles I/O. An attacker can force a VBD to use an unexpected backend, bypassing tapdisk-level access controls, monitoring, and VHD chain processing. The key has no per-key RBAC protection and accepts arbitrary values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0007"
}
],
"title": "Backend-Kind I/O Driver Type Confusion via VBD.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0007"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0007",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0019
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Tapdisk Memory Pool Injection via VDI.other_config mem-pool
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary mem-pool value into VDI.other_config that flows unsanitized to tapdisk - a root-level storage I/O daemon - via xenstore. The SM driver reads other_config mem-pool in blktap2.py without any sanitization and writes it to xenstore as a tapdisk parameter. Tapdisk runs as root and reads the unsanitized pool name from xenstore to configure its memory allocation behavior. This creates a direct injection path from a low-privilege API user into a root-level service configuration.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary mem-pool value into VDI.other_config that flows unsanitized to tapdisk - a root-level storage I/O daemon - via xenstore. The SM driver reads other_config mem-pool in blktap2.py without any sanitization and writes it to xenstore as a tapdisk parameter. Tapdisk runs as root and reads the unsanitized pool name from xenstore to configure its memory allocation behavior. This creates a direct injection path from a low-privilege API user into a root-level service configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0019"
}
],
"title": "Tapdisk Memory Pool Injection via VDI.other_config mem-pool"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0019"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0019",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0043
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
PBD Synchronization Bypass via Pool.other_config sync_create_pbds
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable automatic PBD creation for shared storage repositories by setting sync_create_pbds to nosync in Pool.other_config. The create_storage.ml module checks this value during host boot and skips PBD creation when set, causing shared storage to remain disconnected after reboot. VMs depending on shared storage cannot start. The disruption persists across reboots until the key is manually removed.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable automatic PBD creation for shared storage repositories by setting sync_create_pbds to nosync in Pool.other_config. The create_storage.ml module checks this value during host boot and skips PBD creation when set, causing shared storage to remain disconnected after reboot. VMs depending on shared storage cannot start. The disruption persists across reboots until the key is manually removed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0043"
}
],
"title": "PBD Synchronization Bypass via Pool.other_config sync_create_pbds"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0043"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0043",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0074
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
GC and Coalesce Disablement via SR.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable garbage collection and VHD coalescing on any SR by setting gc=false and/or coalesce=false in SR.other_config. The SM garbage collector reads these keys at cleanup.py:2052 and cleanup.py:2090. When disabled, orphan VDIs accumulate consuming storage, and VHD chains grow unbounded degrading I/O performance until chain-length errors occur. The disablement is silent - no alert, no log, no expiration. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.9 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable garbage collection and VHD coalescing on any SR by setting gc=false and/or coalesce=false in SR.other_config. The SM garbage collector reads these keys at cleanup.py:2052 and cleanup.py:2090. When disabled, orphan VDIs accumulate consuming storage, and VHD chains grow unbounded degrading I/O performance until chain-length errors occur. The disablement is silent - no alert, no log, no expiration. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0074"
}
],
"title": "GC and Coalesce Disablement via SR.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0074"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0074",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0013
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Pool-Wide OVS Fail-Mode Denial of Service via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network outage across every host in the pool by setting Pool.other_config:vswitch-controller-fail-mode to secure. This pool-level key serves as the default fail mode for every OVS bridge without a per-network override. Without an SDN controller - the common deployment case - all network traffic is dropped on all bridges across all hosts pool-wide, affecting every VM, management connection, and storage path in the pool.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network outage across every host in the pool by setting Pool.other_config:vswitch-controller-fail-mode to secure. This pool-level key serves as the default fail mode for every OVS bridge without a per-network override. Without an SDN controller - the common deployment case - all network traffic is dropped on all bridges across all hosts pool-wide, affecting every VM, management connection, and storage path in the pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0013"
}
],
"title": "Pool-Wide OVS Fail-Mode Denial of Service via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0013"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0013",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0034
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Coalesce Blocking via VDI.other_config leaf-coalesce
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0034"
}
],
"title": "Coalesce Blocking via VDI.other_config leaf-coalesce"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0034"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0034",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0062
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Rate Limit Removal via kbps=0 in VIF.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can silently disable VIF rate limiting by setting kbps=0 in VIF.qos_algorithm_params. XAPI accepts the zero value without validation. xenopsd correctly rejects it at plug time (bytes_per_interval fails the >0L check), but the rejection is invisible - only a debug-level log is emitted. The XAPI database shows rate limiting as configured while xenstore has no rate enforced, creating a false positive for administrators and monitoring tools.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can silently disable VIF rate limiting by setting kbps=0 in VIF.qos_algorithm_params. XAPI accepts the zero value without validation. xenopsd correctly rejects it at plug time (bytes_per_interval fails the \u003e0L check), but the rejection is invisible - only a debug-level log is emitted. The XAPI database shows rate limiting as configured while xenstore has no rate enforced, creating a false positive for administrators and monitoring tools."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0062"
}
],
"title": "Rate Limit Removal via kbps=0 in VIF.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0062"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0062",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0088
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Int64 Overflow in bytes_per_interval via VIF.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params kbps and timeslice_us values that cause Int64 overflow in the bytes_per_interval computation at device.ml:835-845. OCaml silently wraps on integer overflow, producing unexpected rate values. xenopsd bounds checking catches most overflow results, but edge cases where the wrapped value falls within the valid range produce rate limits unrelated to the configured kbps. The field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params kbps and timeslice_us values that cause Int64 overflow in the bytes_per_interval computation at device.ml:835-845. OCaml silently wraps on integer overflow, producing unexpected rate values. xenopsd bounds checking catches most overflow results, but edge cases where the wrapped value falls within the valid range produce rate limits unrelated to the configured kbps. The field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0088"
}
],
"title": "Int64 Overflow in bytes_per_interval via VIF.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0088"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0088",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0040
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
CHAP Credential Exposure via PBD.device_config
Summary
CHAP authentication credentials for iSCSI storage connections in XAPI-based hypervisors (XenServer, XCP-ng) are stored in PBD.device_config as chapuser (plaintext) and chappassword_secret (XAPI secret reference). Any pool-operator can read the PBD record to obtain the chapuser and secret reference, then call secret.get_value() to resolve the cleartext password. This enables cross-user credential theft. The credentials are also stored in plaintext in the XAPI database on disk, accessible via BOC-1 filesystem read.
Severity
6.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "CHAP authentication credentials for iSCSI storage connections in XAPI-based hypervisors (XenServer, XCP-ng) are stored in PBD.device_config as chapuser (plaintext) and chappassword_secret (XAPI secret reference). Any pool-operator can read the PBD record to obtain the chapuser and secret reference, then call secret.get_value() to resolve the cleartext password. This enables cross-user credential theft. The credentials are also stored in plaintext in the XAPI database on disk, accessible via BOC-1 filesystem read."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0040"
}
],
"title": "CHAP Credential Exposure via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0040"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0040",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0064
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Database Field Poisoning via VDI.xenstore_data Arbitrary Keys
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary key-value pairs into VDI.xenstore_data, a field designed for SM backend use. The field has zero map_keys_roles, zero write-time validation, and zero sanitization. Injected data persists in the XAPI database and is visible to all API consumers. Downstream systems (backup tools, inventory scanners, orchestration platforms) may trust the values as SM-generated metadata. The xe CLI reports this field as read-only, but programmatic API access bypasses this restriction.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary key-value pairs into VDI.xenstore_data, a field designed for SM backend use. The field has zero map_keys_roles, zero write-time validation, and zero sanitization. Injected data persists in the XAPI database and is visible to all API consumers. Downstream systems (backup tools, inventory scanners, orchestration platforms) may trust the values as SM-generated metadata. The xe CLI reports this field as read-only, but programmatic API access bypasses this restriction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0064"
}
],
"title": "Database Field Poisoning via VDI.xenstore_data Arbitrary Keys"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0064"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0064",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0080
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
I/O Scheduler Sysfs Injection via SR.other_config scheduler
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can write an arbitrary string to the kernel I/O scheduler sysfs interface by setting the scheduler key in SR.other_config. The SM driver reads the value at SR.py:203-224 and passes it to util.set_scheduler, which writes it to /sys/block/*/queue/scheduler with zero XAPI-side validation. The kernel validates the value (rejecting unknown schedulers), limiting direct impact. The concern is the architectural pattern: user-controlled XAPI data flows directly to a kernel control interface. The field has no map_keys_roles entries for infrastructure keys.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can write an arbitrary string to the kernel I/O scheduler sysfs interface by setting the scheduler key in SR.other_config. The SM driver reads the value at SR.py:203-224 and passes it to util.set_scheduler, which writes it to /sys/block/*/queue/scheduler with zero XAPI-side validation. The kernel validates the value (rejecting unknown schedulers), limiting direct impact. The concern is the architectural pattern: user-controlled XAPI data flows directly to a kernel control interface. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0080"
}
],
"title": "I/O Scheduler Sysfs Injection via SR.other_config scheduler"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0080"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0080",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0057
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
FIST Namespace Exposure via VM.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI's actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption.
Severity
5.3 (Medium)
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI\u0027s actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0057"
}
],
"title": "FIST Namespace Exposure via VM.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0057"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0057",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0087
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
QEMU Device Model Selection via VM.platform device-model (Limited by Whitelist)
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VM.platform:device-model to influence QEMU device model selection. A double whitelist limits impact: XAPI sanity_check (vm_platform.ml:38) validates against known profiles, and xenopsd Profile.of_string resolves to hardcoded binary paths. Unknown values default to Qemu_upstream_compat. The attacker cannot force an arbitrary QEMU binary. Impact is limited to selecting between three supported profiles. The field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VM.platform:device-model to influence QEMU device model selection. A double whitelist limits impact: XAPI sanity_check (vm_platform.ml:38) validates against known profiles, and xenopsd Profile.of_string resolves to hardcoded binary paths. Unknown values default to Qemu_upstream_compat. The attacker cannot force an arbitrary QEMU binary. Impact is limited to selecting between three supported profiles. The field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0087"
}
],
"title": "QEMU Device Model Selection via VM.platform device-model (Limited by Whitelist)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0087"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0087",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0020
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
CBT Metadata Corruption via VDI.other_config content_id
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt Change Block Tracking (CBT) metadata by injecting a crafted content_id value into VDI.other_config. The content_id key is used by the XAPI storage bridge to track VDI content identity across activate/deactivate/clone cycles. Incremental backup solutions use content_id to determine the base snapshot for changed-block calculations. A forged UUID causes the backup system to use an incorrect base, missing changed blocks and producing backups that silently lose data on restore.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt Change Block Tracking (CBT) metadata by injecting a crafted content_id value into VDI.other_config. The content_id key is used by the XAPI storage bridge to track VDI content identity across activate/deactivate/clone cycles. Incremental backup solutions use content_id to determine the base snapshot for changed-block calculations. A forged UUID causes the backup system to use an incorrect base, missing changed blocks and producing backups that silently lose data on restore."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0020"
}
],
"title": "CBT Metadata Corruption via VDI.other_config content_id"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0020"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0020",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0009
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
QEMU Serial Host Filesystem Write via VM.platform hvm_serial
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can create arbitrary files on the host filesystem by setting VM.platform:hvm_serial to file:<path>. XAPI reads this key from the raw database record, bypassing the filtered_flags allowlist, and passes it to QEMU as the -serial argument. QEMU creates the target file as root even if the VM fails to start. This chains into all 34 FIST debug points in XAPI, enabling disablement of HA, memory checks, and other safety mechanisms without requiring BOC-1.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can create arbitrary files on the host filesystem by setting VM.platform:hvm_serial to file:\u003cpath\u003e. XAPI reads this key from the raw database record, bypassing the filtered_flags allowlist, and passes it to QEMU as the -serial argument. QEMU creates the target file as root even if the VM fails to start. This chains into all 34 FIST debug points in XAPI, enabling disablement of HA, memory checks, and other safety mechanisms without requiring BOC-1."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0009"
}
],
"title": "QEMU Serial Host Filesystem Write via VM.platform hvm_serial"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0009"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0009",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0032
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Bidirectional Data Exfiltration via VM.xenstore_data Guest-to-XAPI-DB Sync
Summary
The VM.xenstore_data field in XAPI-based hypervisors (XenServer, XCP-ng) creates a bidirectional data channel between guest domains and the XAPI management database. Guest writes to vm-data/ in xenstore are read by xenopsd during periodic state synchronization and propagated into VM.xenstore_data in the XAPI database. This is the only confirmed path where a guest domain can inject data into the XAPI database without API authentication. Any API consumer reading VM.xenstore_data receives attacker-injected values.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "The VM.xenstore_data field in XAPI-based hypervisors (XenServer, XCP-ng) creates a bidirectional data channel between guest domains and the XAPI management database. Guest writes to vm-data/ in xenstore are read by xenopsd during periodic state synchronization and propagated into VM.xenstore_data in the XAPI database. This is the only confirmed path where a guest domain can inject data into the XAPI database without API authentication. Any API consumer reading VM.xenstore_data receives attacker-injected values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0032"
}
],
"title": "Bidirectional Data Exfiltration via VM.xenstore_data Guest-to-XAPI-DB Sync"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0032"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0032",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0063
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Negative kbps Injection in VIF.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject negative kbps values into VIF.qos_algorithm_params. XAPI parses via Int64.of_string without sign validation. xenopsd computes a negative bytes_per_interval which fails the >0L bounds check, silently dropping the rate limit. The XAPI database shows the negative value as the configured rate while no rate is enforced in xenstore, creating an observability gap for administrators and monitoring tools.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject negative kbps values into VIF.qos_algorithm_params. XAPI parses via Int64.of_string without sign validation. xenopsd computes a negative bytes_per_interval which fails the \u003e0L bounds check, silently dropping the rate limit. The XAPI database shows the negative value as the configured rate while no rate is enforced in xenstore, creating an observability gap for administrators and monitoring tools."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0063"
}
],
"title": "Negative kbps Injection in VIF.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0063"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0063",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0041
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Rolling Upgrade State Injection via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a fake rolling upgrade state by writing the rolling_upgrade_in_progress key to Pool.other_config. The mere presence of this key causes helpers.ml to return true, disabling version compatibility checks, altering pool behavior during operations, and preventing detection of version mismatches across the pool. The key has no map_keys_roles protection and no write-time validation.
Severity
6.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a fake rolling upgrade state by writing the rolling_upgrade_in_progress key to Pool.other_config. The mere presence of this key causes helpers.ml to return true, disabling version compatibility checks, altering pool behavior during operations, and preventing detection of version mismatches across the pool. The key has no map_keys_roles protection and no write-time validation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0041"
}
],
"title": "Rolling Upgrade State Injection via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0041"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0041",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0036
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
LVM Configuration Injection via SR.other_config lvm-conf
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary LVM configuration by setting SR.other_config:lvm-conf to a crafted value. The value is interpolated into --config devices{VALUE} in LVM commands executed by SM drivers without sanitization. The LVM --config parameter accepts arbitrary configuration overrides including device filter rules, enabling device filter manipulation that affects which block devices LVM operates on across storage repositories.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary LVM configuration by setting SR.other_config:lvm-conf to a crafted value. The value is interpolated into --config devices{VALUE} in LVM commands executed by SM drivers without sanitization. The LVM --config parameter accepts arbitrary configuration overrides including device filter rules, enabling device filter manipulation that affects which block devices LVM operates on across storage repositories."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0036"
}
],
"title": "LVM Configuration Injection via SR.other_config lvm-conf"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0036"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0036",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0045
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Arbitrary Bond Property Injection via PIF.other_config bond-*
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties by writing keys with the bond- prefix to PIF.other_config. The nm.ml module extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property override with zero validation on property names or values. This enables bond mode changes, timer manipulation, and injection of invalid parameters causing OVS errors and network disruption.
Severity
6.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties by writing keys with the bond- prefix to PIF.other_config. The nm.ml module extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property override with zero validation on property names or values. This enables bond mode changes, timer manipulation, and injection of invalid parameters causing OVS errors and network disruption."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0045"
}
],
"title": "Arbitrary Bond Property Injection via PIF.other_config bond-*"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0045"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0045",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0060
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Arbitrary Integer Passthrough to ionice via VBD.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can pass arbitrary integer values to the Linux ionice binary via the class key in VBD.qos_algorithm_params. The qos_class parser at xapi_xenops.ml:595-600 accepts any integer via Other(int_of_string s), and Ionice.to_class_param passes Other x directly as the -n argument. No range validation is performed - valid range is 0-7 but negative and extreme values are accepted. Kernel behavior with out-of-range ionice values is undefined. Changes take effect immediately without VBD replug.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can pass arbitrary integer values to the Linux ionice binary via the class key in VBD.qos_algorithm_params. The qos_class parser at xapi_xenops.ml:595-600 accepts any integer via Other(int_of_string s), and Ionice.to_class_param passes Other x directly as the -n argument. No range validation is performed - valid range is 0-7 but negative and extreme values are accepted. Kernel behavior with out-of-range ionice values is undefined. Changes take effect immediately without VBD replug."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0060"
}
],
"title": "Arbitrary Integer Passthrough to ionice via VBD.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0060"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0060",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0028
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VDI Lifecycle Corruption via VBD.other_config owner Key
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI's VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI\u0027s VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0028"
}
],
"title": "VDI Lifecycle Corruption via VBD.other_config owner Key"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0028"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0028",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0027
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Gateway/DNS Routing Hijack via PIF.other_config defaultroute/peerdns
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can hijack host-level network routing and DNS resolution by setting defaultroute=true and peerdns=true on an attacker-chosen PIF via PIF.other_config. All host outbound traffic routes through the selected PIF gateway, and all DNS queries resolve through the selected PIF DNS server. This enables man-in-the-middle attacks on management and storage traffic and DNS poisoning at the host level. PIF.other_config has the highest merge precedence in the other_config merge chain.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can hijack host-level network routing and DNS resolution by setting defaultroute=true and peerdns=true on an attacker-chosen PIF via PIF.other_config. All host outbound traffic routes through the selected PIF gateway, and all DNS queries resolve through the selected PIF DNS server. This enables man-in-the-middle attacks on management and storage traffic and DNS poisoning at the host level. PIF.other_config has the highest merge precedence in the other_config merge chain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0027"
}
],
"title": "Gateway/DNS Routing Hijack via PIF.other_config defaultroute/peerdns"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0027"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0027",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0059
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Multi-Tenant Trust Confusion via VM.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject vm-data/* keys into VM.xenstore_data that modify guest behavior across trust boundaries in delegated VM administration environments. Guest OSes treat all vm-data/ entries as trusted hypervisor configuration with no mechanism to distinguish legitimate data from vm-admin-injected data. This enables supply chain attacks via installation source redirection, configuration endpoint hijacking, and credential injection in multi-tenant pools.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject vm-data/* keys into VM.xenstore_data that modify guest behavior across trust boundaries in delegated VM administration environments. Guest OSes treat all vm-data/ entries as trusted hypervisor configuration with no mechanism to distinguish legitimate data from vm-admin-injected data. This enables supply chain attacks via installation source redirection, configuration endpoint hijacking, and credential injection in multi-tenant pools."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0059"
}
],
"title": "Multi-Tenant Trust Confusion via VM.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0059"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0059",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0081
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
I/O Polling Parameter Manipulation via VBD.other_config polling-duration
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VBD.other_config polling-duration and polling-idle-threshold to extreme values within the partially validated range. xenopsd applies these as I/O polling parameters without resource impact assessment. The accepted range includes values that produce suboptimal polling configurations, resulting in VBD performance degradation. The VBD.other_config field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VBD.other_config polling-duration and polling-idle-threshold to extreme values within the partially validated range. xenopsd applies these as I/O polling parameters without resource impact assessment. The accepted range includes values that produce suboptimal polling configurations, resulting in VBD performance degradation. The VBD.other_config field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0081"
}
],
"title": "I/O Polling Parameter Manipulation via VBD.other_config polling-duration"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0081"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0081",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0033
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Rate Limit Bypass via VIF.qos_algorithm_params Large kbps Overflow
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params:kbps to an extremely large value that causes bytes_per_interval to exceed 0xffffffffL during computation in xenopsd. xenopsd correctly rejects the out-of-range value but does so silently with only a debug-level log. XAPI continues to show the configured rate limit in the database. The VM operates without network rate limiting while the management plane reports it as enforced.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params:kbps to an extremely large value that causes bytes_per_interval to exceed 0xffffffffL during computation in xenopsd. xenopsd correctly rejects the out-of-range value but does so silently with only a debug-level log. XAPI continues to show the configured rate limit in the database. The VM operates without network rate limiting while the management plane reports it as enforced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0033"
}
],
"title": "Rate Limit Bypass via VIF.qos_algorithm_params Large kbps Overflow"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0033"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0033",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}