Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
99 vulnerabilities by Cloud Software Group
MOKSHA-2026-0087
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
QEMU Device Model Selection via VM.platform device-model (Limited by Whitelist)
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VM.platform:device-model to influence QEMU device model selection. A double whitelist limits impact: XAPI sanity_check (vm_platform.ml:38) validates against known profiles, and xenopsd Profile.of_string resolves to hardcoded binary paths. Unknown values default to Qemu_upstream_compat. The attacker cannot force an arbitrary QEMU binary. Impact is limited to selecting between three supported profiles. The field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VM.platform:device-model to influence QEMU device model selection. A double whitelist limits impact: XAPI sanity_check (vm_platform.ml:38) validates against known profiles, and xenopsd Profile.of_string resolves to hardcoded binary paths. Unknown values default to Qemu_upstream_compat. The attacker cannot force an arbitrary QEMU binary. Impact is limited to selecting between three supported profiles. The field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0087"
}
],
"title": "QEMU Device Model Selection via VM.platform device-model (Limited by Whitelist)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0087"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0087",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0067
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Cross-Pool Metadata Injection via VDI.xenstore_data on Pool Join
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can poison VDI.xenstore_data on a source pool, and the poisoned metadata crosses into a target pool during pool join or cross-pool migration. The pool join code at xapi_pool.ml:1215 copies VDI records including xenstore_data without re-validation or sanitization. This enables a compromised vm-admin on one pool to inject attacker-controlled storage metadata into a separate, previously uncompromised pool.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can poison VDI.xenstore_data on a source pool, and the poisoned metadata crosses into a target pool during pool join or cross-pool migration. The pool join code at xapi_pool.ml:1215 copies VDI records including xenstore_data without re-validation or sanitization. This enables a compromised vm-admin on one pool to inject attacker-controlled storage metadata into a separate, previously uncompromised pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0067"
}
],
"title": "Cross-Pool Metadata Injection via VDI.xenstore_data on Pool Join"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0067"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0067",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0043
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
PBD Synchronization Bypass via Pool.other_config sync_create_pbds
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable automatic PBD creation for shared storage repositories by setting sync_create_pbds to nosync in Pool.other_config. The create_storage.ml module checks this value during host boot and skips PBD creation when set, causing shared storage to remain disconnected after reboot. VMs depending on shared storage cannot start. The disruption persists across reboots until the key is manually removed.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable automatic PBD creation for shared storage repositories by setting sync_create_pbds to nosync in Pool.other_config. The create_storage.ml module checks this value during host boot and skips PBD creation when set, causing shared storage to remain disconnected after reboot. VMs depending on shared storage cannot start. The disruption persists across reboots until the key is manually removed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0043"
}
],
"title": "PBD Synchronization Bypass via Pool.other_config sync_create_pbds"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0043"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0043",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0009
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
QEMU Serial Host Filesystem Write via VM.platform hvm_serial
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can create arbitrary files on the host filesystem by setting VM.platform:hvm_serial to file:<path>. XAPI reads this key from the raw database record, bypassing the filtered_flags allowlist, and passes it to QEMU as the -serial argument. QEMU creates the target file as root even if the VM fails to start. This chains into all 34 FIST debug points in XAPI, enabling disablement of HA, memory checks, and other safety mechanisms without requiring BOC-1.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can create arbitrary files on the host filesystem by setting VM.platform:hvm_serial to file:\u003cpath\u003e. XAPI reads this key from the raw database record, bypassing the filtered_flags allowlist, and passes it to QEMU as the -serial argument. QEMU creates the target file as root even if the VM fails to start. This chains into all 34 FIST debug points in XAPI, enabling disablement of HA, memory checks, and other safety mechanisms without requiring BOC-1."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0009"
}
],
"title": "QEMU Serial Host Filesystem Write via VM.platform hvm_serial"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0009"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0009",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0026
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Python Module Import Injection via Host.other_config multipathhandle
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a controlled Python module name via Host.other_config:multipathhandle. The SM driver SR._mpathinit() passes this value to Python __import__() as mpath_<value>. Combined with a file write primitive (provided by BOC-1), an attacker places a malicious .py file in /opt/xensource/sm/ and triggers import as root during the next SR operation. Standalone exploitation requires pool-operator plus an independent file write capability.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a controlled Python module name via Host.other_config:multipathhandle. The SM driver SR._mpathinit() passes this value to Python __import__() as mpath_\u003cvalue\u003e. Combined with a file write primitive (provided by BOC-1), an attacker places a malicious .py file in /opt/xensource/sm/ and triggers import as root during the next SR operation. Standalone exploitation requires pool-operator plus an independent file write capability."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-913",
"description": "Improper Control of Dynamically-Managed Code Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0026"
}
],
"title": "Python Module Import Injection via Host.other_config multipathhandle"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0026"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0026",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0018
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
HA Timeout Manipulation via Pool.other_config (Split-Brain/Blindness)
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the High Availability timeout by setting Pool.other_config:default_ha_timeout to an arbitrary integer. The value is read by xapi_ha.ml via int_of_string with no range check. A timeout of 1 second causes spurious HA fencing events and cascading host reboots (split-brain). A timeout of 999999 seconds effectively disables HA, leaving host failures undetected for days and HA-protected VMs without failover. Both outcomes affect every HA-protected VM across the entire pool.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the High Availability timeout by setting Pool.other_config:default_ha_timeout to an arbitrary integer. The value is read by xapi_ha.ml via int_of_string with no range check. A timeout of 1 second causes spurious HA fencing events and cascading host reboots (split-brain). A timeout of 999999 seconds effectively disables HA, leaving host failures undetected for days and HA-protected VMs without failover. Both outcomes affect every HA-protected VM across the entire pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0018"
}
],
"title": "HA Timeout Manipulation via Pool.other_config (Split-Brain/Blindness)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0018"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0018",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0084
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Firmware Type Denial of Service via VM.HVM_boot_params firmware
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disrupt VM boot by writing an invalid value to VM.HVM_boot_params:firmware or removing the key. XAPI accepts any value at write time but validates at VM start (xapi_xenops.ml:255-268), raising Server_error on invalid values. Firmware key removal causes BIOS fallback, rendering UEFI guests unbootable. The impact is limited because vm-admin already has VM.hard_shutdown capability. The field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disrupt VM boot by writing an invalid value to VM.HVM_boot_params:firmware or removing the key. XAPI accepts any value at write time but validates at VM start (xapi_xenops.ml:255-268), raising Server_error on invalid values. Firmware key removal causes BIOS fallback, rendering UEFI guests unbootable. The impact is limited because vm-admin already has VM.hard_shutdown capability. The field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0084"
}
],
"title": "Firmware Type Denial of Service via VM.HVM_boot_params firmware"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0084"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0084",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0012
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
OVS Fail-Mode Denial of Service via Network.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network denial of service on any OVS bridge by setting Network.other_config:vswitch-controller-fail-mode to secure. In secure fail mode, OVS drops all packets when no SDN controller is reachable. Since most XAPI deployments do not configure an SDN controller, this immediately drops all traffic on the bridge, affecting every VM and management connection on that network.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network denial of service on any OVS bridge by setting Network.other_config:vswitch-controller-fail-mode to secure. In secure fail mode, OVS drops all packets when no SDN controller is reachable. Since most XAPI deployments do not configure an SDN controller, this immediately drops all traffic on the bridge, affecting every VM and management connection on that network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0012"
}
],
"title": "OVS Fail-Mode Denial of Service via Network.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0012"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0012",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0077
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VIF NIC Offload Disablement via VIF.other_config ethtool Keys
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC offload features (TSO, GSO, etc.) on VIF backend devices by setting ethtool-tso=off and similar keys in VIF.other_config. The VIF hotplug script (vif-real:85-97) executes ethtool -K to disable offloads. This forces host CPU to perform software segmentation, increasing CPU utilization and degrading performance for co-located VMs. VIF.other_config has zero map_keys_roles entries - all ethtool keys are writable by vm-admin.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC offload features (TSO, GSO, etc.) on VIF backend devices by setting ethtool-tso=off and similar keys in VIF.other_config. The VIF hotplug script (vif-real:85-97) executes ethtool -K to disable offloads. This forces host CPU to perform software segmentation, increasing CPU utilization and degrading performance for co-located VMs. VIF.other_config has zero map_keys_roles entries - all ethtool keys are writable by vm-admin."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0077"
}
],
"title": "VIF NIC Offload Disablement via VIF.other_config ethtool Keys"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0077"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0077",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0034
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Coalesce Blocking via VDI.other_config leaf-coalesce
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can permanently block VHD leaf coalesce operations on any VDI by setting VDI.other_config:leaf-coalesce to false. The SM garbage collector reads this key and skips leaf coalesce when the value is false. Snapshot chains grow unbounded, consuming storage until the SR reaches capacity or the VHD chain exceeds maximum depth. The same mechanism allows disabling all garbage collection via gc=false or coalesce=false. These keys have no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0034"
}
],
"title": "Coalesce Blocking via VDI.other_config leaf-coalesce"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0034"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0034",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0061
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
I/O Scheduling Downgrade to Idle Class via VBD.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can downgrade a target VM's I/O scheduling class to idle by setting sched=idle in VBD.qos_algorithm_params. The idle class causes the kernel to service VBD kernel threads only when no other I/O is pending. Under any host I/O load, the target VM experiences severe I/O starvation. The field has zero map_keys_roles entries, and QoS changes take effect immediately via hot-apply without VBD replug.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can downgrade a target VM\u0027s I/O scheduling class to idle by setting sched=idle in VBD.qos_algorithm_params. The idle class causes the kernel to service VBD kernel threads only when no other I/O is pending. Under any host I/O load, the target VM experiences severe I/O starvation. The field has zero map_keys_roles entries, and QoS changes take effect immediately via hot-apply without VBD replug."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0061"
}
],
"title": "I/O Scheduling Downgrade to Idle Class via VBD.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0061"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0061",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0069
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Hypervisor Security Feature Manipulation via VM.platform (nx/hap)
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable CPU security features by writing to VM.platform keys. Setting nx=false removes DEP protection, hap=false forces shadow paging, nested-virt=true expands the hypervisor attack surface, and extreme max_grant_frames/max_maptrack_frames values cause resource exhaustion. The field has zero map_keys_roles entries - all security-critical hypervisor keys are writable by the lowest delegated management role.
Severity
5.3 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can disable CPU security features by writing to VM.platform keys. Setting nx=false removes DEP protection, hap=false forces shadow paging, nested-virt=true expands the hypervisor attack surface, and extreme max_grant_frames/max_maptrack_frames values cause resource exhaustion. The field has zero map_keys_roles entries - all security-critical hypervisor keys are writable by the lowest delegated management role."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0069"
}
],
"title": "Hypervisor Security Feature Manipulation via VM.platform (nx/hap)"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0069"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0069",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0038
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Provisioning Type Manipulation via SR.sm_config allocation
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt storage provisioning behavior by modifying or removing the allocation key in SR.sm_config after SR creation. The key controls whether LVHD SRs use thin or thick provisioning. Changing allocation from thin to thick causes new VDIs to pre-allocate full LV size instead of thin-provisioning. On overcommitted SRs, this causes immediate storage exhaustion. Restoring the key does not shrink already-inflated LVs - recovery requires storage migration.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt storage provisioning behavior by modifying or removing the allocation key in SR.sm_config after SR creation. The key controls whether LVHD SRs use thin or thick provisioning. Changing allocation from thin to thick causes new VDIs to pre-allocate full LV size instead of thin-provisioning. On overcommitted SRs, this causes immediate storage exhaustion. Restoring the key does not shrink already-inflated LVs - recovery requires storage migration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0038"
}
],
"title": "Provisioning Type Manipulation via SR.sm_config allocation"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0038"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0038",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0011
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VIF Backend VM Hijack via Network.other_config backend_vm
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can redirect all VIF traffic on a network through an attacker-controlled VM by setting Network.other_config:backend_vm to a VM UUID they control. XAPI reads this key in xapi_xenops.ml and returns Network.Remote(backend_vm, bridge) instead of Network.Local(bridge) for all subsequent VIF creations on that network. All VMs connected to the network have their traffic routed through the attacker VM, enabling traffic interception, credential sniffing, and man-in-the-middle attacks.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can redirect all VIF traffic on a network through an attacker-controlled VM by setting Network.other_config:backend_vm to a VM UUID they control. XAPI reads this key in xapi_xenops.ml and returns Network.Remote(backend_vm, bridge) instead of Network.Local(bridge) for all subsequent VIF creations on that network. All VMs connected to the network have their traffic routed through the attacker VM, enabling traffic interception, credential sniffing, and man-in-the-middle attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0011"
}
],
"title": "VIF Backend VM Hijack via Network.other_config backend_vm"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0011"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0011",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0028
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
VDI Lifecycle Corruption via VBD.other_config owner Key
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI's VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI\u0027s VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0028"
}
],
"title": "VDI Lifecycle Corruption via VBD.other_config owner Key"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0028"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0028",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0008
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Storage Driver Domain PBD Detach DoS via VM.other_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD's SR and sets the PBD's currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM's lifecycle.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD\u0027s SR and sets the PBD\u0027s currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM\u0027s lifecycle."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0008"
}
],
"title": "Storage Driver Domain PBD Detach DoS via VM.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0008"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0008",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0085
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Feature Restriction Bypass via Host.license_params restrict_* Keys
Summary
An attacker with root access on an XAPI-based hypervisor host (XenServer, XCP-ng) can modify the XAPI database to set restrict_* keys in Host.license_params to false, enabling licensed features without a valid license. The field has the strongest access control in XAPI (_R_LOCAL_ROOT_ONLY, pool_internal, DynamicRO) and is not exposed via the network API. This is a license compliance issue - an attacker with root already has full system control.
Severity
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker with root access on an XAPI-based hypervisor host (XenServer, XCP-ng) can modify the XAPI database to set restrict_* keys in Host.license_params to false, enabling licensed features without a valid license. The field has the strongest access control in XAPI (_R_LOCAL_ROOT_ONLY, pool_internal, DynamicRO) and is not exposed via the network API. This is a license compliance issue - an attacker with root already has full system control."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0085"
}
],
"title": "Feature Restriction Bypass via Host.license_params restrict_* Keys"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0085"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0085",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0024
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
NFS Mount Option Injection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary NFS mount options via PBD.device_config:options when creating an NFS storage repository. The NFSSR driver appends these options directly to the mount.nfs command without sanitization. An attacker can inject sec=none to disable NFS authentication, noac to cause performance denial of service, or ro to force read-only access. The attack was confirmed via live testing with all checks passing.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary NFS mount options via PBD.device_config:options when creating an NFS storage repository. The NFSSR driver appends these options directly to the mount.nfs command without sanitization. An attacker can inject sec=none to disable NFS authentication, noac to cause performance denial of service, or ro to force read-only access. The attack was confirmed via live testing with all checks passing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0024"
}
],
"title": "NFS Mount Option Injection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0024"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0024",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0081
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
I/O Polling Parameter Manipulation via VBD.other_config polling-duration
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VBD.other_config polling-duration and polling-idle-threshold to extreme values within the partially validated range. xenopsd applies these as I/O polling parameters without resource impact assessment. The accepted range includes values that produce suboptimal polling configurations, resulting in VBD performance degradation. The VBD.other_config field has zero map_keys_roles entries.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VBD.other_config polling-duration and polling-idle-threshold to extreme values within the partially validated range. xenopsd applies these as I/O polling parameters without resource impact assessment. The accepted range includes values that produce suboptimal polling configurations, resulting in VBD performance degradation. The VBD.other_config field has zero map_keys_roles entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0081"
}
],
"title": "I/O Polling Parameter Manipulation via VBD.other_config polling-duration"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0081"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0081",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0049
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
HIMN Identity Hijack + DHCP Manipulation via Network.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can hijack the Host Internal Management Network (HIMN) identity or manipulate guest VM DHCP configuration by modifying is_host_internal_management_network, ip_begin, ip_end, and netmask keys in Network.other_config. Marking a second network as HIMN creates identity ambiguity in XAPI's List.find resolution. Modifying the DHCP range enables IP exhaustion attacks or assignment of IPs outside the expected link-local range, disrupting guest agent communication.
Severity
5.5 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can hijack the Host Internal Management Network (HIMN) identity or manipulate guest VM DHCP configuration by modifying is_host_internal_management_network, ip_begin, ip_end, and netmask keys in Network.other_config. Marking a second network as HIMN creates identity ambiguity in XAPI\u0027s List.find resolution. Modifying the DHCP range enables IP exhaustion attacks or assignment of IPs outside the expected link-local range, disrupting guest agent communication."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0049"
}
],
"title": "HIMN Identity Hijack + DHCP Manipulation via Network.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0049"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0049",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0013
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Pool-Wide OVS Fail-Mode Denial of Service via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network outage across every host in the pool by setting Pool.other_config:vswitch-controller-fail-mode to secure. This pool-level key serves as the default fail mode for every OVS bridge without a per-network override. Without an SDN controller - the common deployment case - all network traffic is dropped on all bridges across all hosts pool-wide, affecting every VM, management connection, and storage path in the pool.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network outage across every host in the pool by setting Pool.other_config:vswitch-controller-fail-mode to secure. This pool-level key serves as the default fail mode for every OVS bridge without a per-network override. Without an SDN controller - the common deployment case - all network traffic is dropped on all bridges across all hosts pool-wide, affecting every VM, management connection, and storage path in the pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0013"
}
],
"title": "Pool-Wide OVS Fail-Mode Denial of Service via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0013"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0013",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0036
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
LVM Configuration Injection via SR.other_config lvm-conf
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary LVM configuration by setting SR.other_config:lvm-conf to a crafted value. The value is interpolated into --config devices{VALUE} in LVM commands executed by SM drivers without sanitization. The LVM --config parameter accepts arbitrary configuration overrides including device filter rules, enabling device filter manipulation that affects which block devices LVM operates on across storage repositories.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary LVM configuration by setting SR.other_config:lvm-conf to a crafted value. The value is interpolated into --config devices{VALUE} in LVM commands executed by SM drivers without sanitization. The LVM --config parameter accepts arbitrary configuration overrides including device filter rules, enabling device filter manipulation that affects which block devices LVM operates on across storage repositories."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0036"
}
],
"title": "LVM Configuration Injection via SR.other_config lvm-conf"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0036"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0036",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0035
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. Storage targets using IQN-based ACLs grant access based on the spoofed identity, enabling unauthorized access to LUNs belonging to other hosts or tenants.
Severity
6.8 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host\u0027s iSCSI initiator identity by setting Host.other_config:iscsi_iqn to an arbitrary IQN string. The XAPI event watcher thread syncs this value to /etc/iscsi/initiatorname.iscsi without format validation. All subsequent iSCSI operations use the spoofed initiator name. Storage targets using IQN-based ACLs grant access based on the spoofed identity, enabling unauthorized access to LUNs belonging to other hosts or tenants."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0035"
}
],
"title": "iSCSI Initiator Identity Spoofing via Host.other_config iscsi_iqn"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0035"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0035",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0010
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Block Device Path Injection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. A systemroot check protects the host root device, but does not protect other partitions, additional disks, remote block devices, or other VMs' local storage. Data destruction on arbitrary accessible block devices results.
Severity
CWE
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. A systemroot check protects the host root device, but does not protect other partitions, additional disks, remote block devices, or other VMs\u0027 local storage. Data destruction on arbitrary accessible block devices results."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:L/SI:L/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0010"
}
],
"title": "Block Device Path Injection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0010"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0010",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0007
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Backend-Kind I/O Driver Type Confusion via VBD.other_config
Summary
A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can change the storage I/O backend driver for any VBD by writing to VBD.other_config:backend-kind. This key selects whether kernel blkback or userspace tapdisk handles I/O. An attacker can force a VBD to use an unexpected backend, bypassing tapdisk-level access controls, monitoring, and VHD chain processing. The key has no per-key RBAC protection and accepts arbitrary values.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can change the storage I/O backend driver for any VBD by writing to VBD.other_config:backend-kind. This key selects whether kernel blkback or userspace tapdisk handles I/O. An attacker can force a VBD to use an unexpected backend, bypassing tapdisk-level access controls, monitoring, and VHD chain processing. The key has no per-key RBAC protection and accepts arbitrary values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0007"
}
],
"title": "Backend-Kind I/O Driver Type Confusion via VBD.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0007"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0007",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0023
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Guest Agent Script Execution Enablement via Pool.other_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can enable execution of arbitrary scripts within guest VMs by setting Pool.other_config:allow_guest_agent_run_script to true. This enables the guest agent run-script capability pool-wide, allowing the operator to execute commands inside any VM with the guest agent installed. This is a privilege escalation from host-level management to guest-level code execution. The key has no per-key RBAC protection and no write-time validation.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can enable execution of arbitrary scripts within guest VMs by setting Pool.other_config:allow_guest_agent_run_script to true. This enables the guest agent run-script capability pool-wide, allowing the operator to execute commands inside any VM with the guest agent installed. This is a privilege escalation from host-level management to guest-level code execution. The key has no per-key RBAC protection and no write-time validation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0023"
}
],
"title": "Guest Agent Script Execution Enablement via Pool.other_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0023"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0023",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0079
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Network Sharing Bypass via Network.other_config assume_network_is_shared
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can bypass network locality checks by setting assume_network_is_shared=true in Network.other_config. The key is checked at xapi_network_attach_helpers.ml:132-133. When set, XAPI treats the network as shared across all hosts regardless of actual PIF connectivity, allowing VMs to start on hosts without network infrastructure. This causes VIF attachment failures or silent connectivity loss. The field has no map_keys_roles entries for infrastructure keys.
Severity
4.1 (Medium)
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can bypass network locality checks by setting assume_network_is_shared=true in Network.other_config. The key is checked at xapi_network_attach_helpers.ml:132-133. When set, XAPI treats the network as shared across all hosts regardless of actual PIF connectivity, allowing VMs to start on hosts without network infrastructure. This causes VIF attachment failures or silent connectivity loss. The field has no map_keys_roles entries for infrastructure keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0079"
}
],
"title": "Network Sharing Bypass via Network.other_config assume_network_is_shared"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0079"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0079",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0062
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Rate Limit Removal via kbps=0 in VIF.qos_algorithm_params
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can silently disable VIF rate limiting by setting kbps=0 in VIF.qos_algorithm_params. XAPI accepts the zero value without validation. xenopsd correctly rejects it at plug time (bytes_per_interval fails the >0L check), but the rejection is invisible - only a debug-level log is emitted. The XAPI database shows rate limiting as configured while xenstore has no rate enforced, creating a false positive for administrators and monitoring tools.
Severity
5.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can silently disable VIF rate limiting by setting kbps=0 in VIF.qos_algorithm_params. XAPI accepts the zero value without validation. xenopsd correctly rejects it at plug time (bytes_per_interval fails the \u003e0L check), but the rejection is invisible - only a debug-level log is emitted. The XAPI database shows rate limiting as configured while xenstore has no rate enforced, creating a false positive for administrators and monitoring tools."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0062"
}
],
"title": "Rate Limit Removal via kbps=0 in VIF.qos_algorithm_params"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0062"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0062",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0058
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Xenstore Quota Exhaustion via VM.xenstore_data
Summary
A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can exhaust a guest domain's xenstore quota by injecting a large number of vm-data/* keys into VM.xenstore_data. Xenstore enforces a per-domain quota shared with guest agent data. When injected data consumes the quota, the guest's own xenstore operations fail, disrupting PV drivers, network configuration, and guest agent communication. The field has zero map_keys_roles entries and no value length limits.
Severity
5.3 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can exhaust a guest domain\u0027s xenstore quota by injecting a large number of vm-data/* keys into VM.xenstore_data. Xenstore enforces a per-domain quota shared with guest agent data. When injected data consumes the quota, the guest\u0027s own xenstore operations fail, disrupting PV drivers, network configuration, and guest agent communication. The field has zero map_keys_roles entries and no value length limits."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0058"
}
],
"title": "Xenstore Quota Exhaustion via VM.xenstore_data"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0058"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0058",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
MOKSHA-2026-0014
Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
VLAI
EPSS
VEX
Title
Local Initiator IQN Injection via PBD.device_config
Summary
A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host's iSCSI initiator identity by injecting an arbitrary IQN via PBD.device_config:localIQN. The SM driver calls iscsilib.set_IQN() which writes the attacker-supplied value to /etc/iscsi/initiatorname.iscsi. All subsequent iSCSI operations from the host use the spoofed IQN, bypassing storage array access controls based on initiator identity. Enterprise storage arrays commonly use IQN-based ACLs as the primary access control mechanism for iSCSI LUNs.
Severity
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Software Group | XenServer |
Affected:
all
(custom)
|
|
| Vates | XCP-ng |
Affected:
all
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XenServer",
"vendor": "Cloud Software Group",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"product": "XCP-ng",
"vendor": "Vates",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakob Wolffhechel, Moksha"
}
],
"descriptions": [
{
"lang": "en",
"value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can overwrite the host\u0027s iSCSI initiator identity by injecting an arbitrary IQN via PBD.device_config:localIQN. The SM driver calls iscsilib.set_IQN() which writes the attacker-supplied value to /etc/iscsi/initiatorname.iscsi. All subsequent iSCSI operations from the host use the spoofed IQN, bypassing storage array access controls based on initiator identity. Enterprise storage arrays commonly use IQN-based ACLs as the primary access control mechanism for iSCSI LUNs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:00Z",
"orgId": "moksha.dk",
"shortName": "Moksha"
},
"references": [
{
"url": "https://cna.moksha.dk/MOKSHA-2026-0014"
}
],
"title": "Local Initiator IQN Injection via PBD.device_config"
}
},
"cveMetadata": {
"alternateIds": [
"GCVE-117-2026-0014"
],
"assignerOrgId": "moksha.dk",
"cveId": "MOKSHA-2026-0014",
"datePublished": "2026-04-24T06:00:00Z",
"state": "PUBLISHED",
"x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}