Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    89 vulnerabilities found for XCP-ng by Vates

    MOKSHA-2026-0050

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    LUNperVDI Mode Manipulation via SR.sm_config
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt the VDI management mode of a storage repository by adding or removing the LUNperVDI key in SR.sm_config. This key controls whether the SR maps one LUN per VDI or uses shared LUNs with VHD containers. Mode mismatch causes VDI creation, deletion, and scanning failures. The sm_config field has zero map_keys_roles entries and remains writable after SR creation despite being intended as driver-managed metadata.
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt the VDI management mode of a storage repository by adding or removing the LUNperVDI key in SR.sm_config. This key controls whether the SR maps one LUN per VDI or uses shared LUNs with VHD containers. Mode mismatch causes VDI creation, deletion, and scanning failures. The sm_config field has zero map_keys_roles entries and remains writable after SR creation despite being intended as driver-managed metadata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0050"
        }
      ],
      "title": "LUNperVDI Mode Manipulation via SR.sm_config"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0050"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0050",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0028

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    VDI Lifecycle Corruption via VBD.other_config owner Key
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI's VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the owner key in VBD.other_config to cause unintended VDI deletion or prevent VDI cleanup during VM uninstall operations. Setting owner on a shared VDI\u0027s VBD causes the VDI to be destroyed when the VM is uninstalled, even though other VMs still reference it. Removing the owner key causes VDIs to be orphaned, leading to gradual storage exhaustion. The key has no per-key RBAC protection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0028"
        }
      ],
      "title": "VDI Lifecycle Corruption via VBD.other_config owner Key"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0028"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0028",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0032

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Bidirectional Data Exfiltration via VM.xenstore_data Guest-to-XAPI-DB Sync
    Summary
    The VM.xenstore_data field in XAPI-based hypervisors (XenServer, XCP-ng) creates a bidirectional data channel between guest domains and the XAPI management database. Guest writes to vm-data/ in xenstore are read by xenopsd during periodic state synchronization and propagated into VM.xenstore_data in the XAPI database. This is the only confirmed path where a guest domain can inject data into the XAPI database without API authentication. Any API consumer reading VM.xenstore_data receives attacker-injected values.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-653 - Improper Isolation or Compartmentalization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The VM.xenstore_data field in XAPI-based hypervisors (XenServer, XCP-ng) creates a bidirectional data channel between guest domains and the XAPI management database. Guest writes to vm-data/ in xenstore are read by xenopsd during periodic state synchronization and propagated into VM.xenstore_data in the XAPI database. This is the only confirmed path where a guest domain can inject data into the XAPI database without API authentication. Any API consumer reading VM.xenstore_data receives attacker-injected values."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-653",
              "description": "Improper Isolation or Compartmentalization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0032"
        }
      ],
      "title": "Bidirectional Data Exfiltration via VM.xenstore_data Guest-to-XAPI-DB Sync"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0032"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0032",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0026

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Python Module Import Injection via Host.other_config multipathhandle
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a controlled Python module name via Host.other_config:multipathhandle. The SM driver SR._mpathinit() passes this value to Python __import__() as mpath_<value>. Combined with a file write primitive (provided by BOC-1), an attacker places a malicious .py file in /opt/xensource/sm/ and triggers import as root during the next SR operation. Standalone exploitation requires pool-operator plus an independent file write capability.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    7.5 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    • CWE-913 - Improper Control of Dynamically-Managed Code Resources
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject a controlled Python module name via Host.other_config:multipathhandle. The SM driver SR._mpathinit() passes this value to Python __import__() as mpath_\u003cvalue\u003e. Combined with a file write primitive (provided by BOC-1), an attacker places a malicious .py file in /opt/xensource/sm/ and triggers import as root during the next SR operation. Standalone exploitation requires pool-operator plus an independent file write capability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0026"
        }
      ],
      "title": "Python Module Import Injection via Host.other_config multipathhandle"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0026"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0026",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0076

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Network Offload Disablement via PIF.other_config ethtool Keys
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC hardware offload features on any physical interface by writing ethtool-gro=off, ethtool-tso=off, etc. to PIF.other_config. These keys are consumed at nm.ml:45-110 and applied via xcp-networkd. Disabling offloads forces software packet processing, degrading performance for all VMs and management traffic. The ethtool-gro key overrides the PIF.properties:gro first-class field via a backward compatibility path. PIF.other_config has zero map_keys_roles entries and highest merge precedence in the other_config chain.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC hardware offload features on any physical interface by writing ethtool-gro=off, ethtool-tso=off, etc. to PIF.other_config. These keys are consumed at nm.ml:45-110 and applied via xcp-networkd. Disabling offloads forces software packet processing, degrading performance for all VMs and management traffic. The ethtool-gro key overrides the PIF.properties:gro first-class field via a backward compatibility path. PIF.other_config has zero map_keys_roles entries and highest merge precedence in the other_config chain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0076"
        }
      ],
      "title": "Network Offload Disablement via PIF.other_config ethtool Keys"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0076"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0076",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0037

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    VHD Test Mode and Failure Injection via SR.other_config testmode
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can activate VHD failure injection on production storage by setting SR.other_config:testmode to a recognized test mode string. The SM driver matches the value against the ENV_VAR_VHD_TEST dictionary, and matching values cause environment variables to be set that instruct vhd-util to simulate failures during structural VHD operations. The resulting failures leave VHD metadata in an inconsistent state - a targeted data corruption attack indistinguishable from legitimate internal errors.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
    7.0 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N
    CWE
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can activate VHD failure injection on production storage by setting SR.other_config:testmode to a recognized test mode string. The SM driver matches the value against the ENV_VAR_VHD_TEST dictionary, and matching values cause environment variables to be set that instruct vhd-util to simulate failures during structural VHD operations. The resulting failures leave VHD metadata in an inconsistent state - a targeted data corruption attack indistinguishable from legitimate internal errors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-489",
              "description": "Active Debug Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0037"
        }
      ],
      "title": "VHD Test Mode and Failure Injection via SR.other_config testmode"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0037"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0037",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0057

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    FIST Namespace Exposure via VM.xenstore_data
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI's actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject FIST/-prefixed keys into VM.xenstore_data, polluting the Fault Injection Service Testing namespace. The FIST prefix is included in allowed_xsdata_prefixes at domain.ml:164, allowing these keys to pass through the xenopsd filter. While XAPI\u0027s actual fault injection reads /tmp/fist_* files on disk (not xenstore), the namespace pollution persists across VM restarts and establishes a pre-positioned injection path for future xenstore-based FIST consumption."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0057"
        }
      ],
      "title": "FIST Namespace Exposure via VM.xenstore_data"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0057"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0057",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0087

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    QEMU Device Model Selection via VM.platform device-model (Limited by Whitelist)
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VM.platform:device-model to influence QEMU device model selection. A double whitelist limits impact: XAPI sanity_check (vm_platform.ml:38) validates against known profiles, and xenopsd Profile.of_string resolves to hardcoded binary paths. Unknown values default to Qemu_upstream_compat. The attacker cannot force an arbitrary QEMU binary. Impact is limited to selecting between three supported profiles. The field has zero map_keys_roles entries.
    Severity
    2.3 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VM.platform:device-model to influence QEMU device model selection. A double whitelist limits impact: XAPI sanity_check (vm_platform.ml:38) validates against known profiles, and xenopsd Profile.of_string resolves to hardcoded binary paths. Unknown values default to Qemu_upstream_compat. The attacker cannot force an arbitrary QEMU binary. Impact is limited to selecting between three supported profiles. The field has zero map_keys_roles entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0087"
        }
      ],
      "title": "QEMU Device Model Selection via VM.platform device-model (Limited by Whitelist)"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0087"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0087",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0074

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    GC and Coalesce Disablement via SR.other_config
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable garbage collection and VHD coalescing on any SR by setting gc=false and/or coalesce=false in SR.other_config. The SM garbage collector reads these keys at cleanup.py:2052 and cleanup.py:2090. When disabled, orphan VDIs accumulate consuming storage, and VHD chains grow unbounded degrading I/O performance until chain-length errors occur. The disablement is silent - no alert, no log, no expiration. The field has no map_keys_roles entries for infrastructure keys.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable garbage collection and VHD coalescing on any SR by setting gc=false and/or coalesce=false in SR.other_config. The SM garbage collector reads these keys at cleanup.py:2052 and cleanup.py:2090. When disabled, orphan VDIs accumulate consuming storage, and VHD chains grow unbounded degrading I/O performance until chain-length errors occur. The disablement is silent - no alert, no log, no expiration. The field has no map_keys_roles entries for infrastructure keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0074"
        }
      ],
      "title": "GC and Coalesce Disablement via SR.other_config"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0074"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0074",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0082

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    VDI Lifecycle Behavior Manipulation via VDI.other_config on_boot/cbt_enabled
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can modify VDI.other_config on_boot and cbt_enabled keys without validation. The on_boot key controls VDI reset-on-boot behavior, and cbt_enabled is an other_config mirror of the first-class CBT field read by SM drivers at VDI.py:831-837. Manipulation changes VDI persistence behavior (data loss on reboot) and change block tracking state. The VDI.other_config field has map_keys_roles entries only for UI keys.
    Severity
    3.1 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can modify VDI.other_config on_boot and cbt_enabled keys without validation. The on_boot key controls VDI reset-on-boot behavior, and cbt_enabled is an other_config mirror of the first-class CBT field read by SM drivers at VDI.py:831-837. Manipulation changes VDI persistence behavior (data loss on reboot) and change block tracking state. The VDI.other_config field has map_keys_roles entries only for UI keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0082"
        }
      ],
      "title": "VDI Lifecycle Behavior Manipulation via VDI.other_config on_boot/cbt_enabled"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0082"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0082",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0060

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Arbitrary Integer Passthrough to ionice via VBD.qos_algorithm_params
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can pass arbitrary integer values to the Linux ionice binary via the class key in VBD.qos_algorithm_params. The qos_class parser at xapi_xenops.ml:595-600 accepts any integer via Other(int_of_string s), and Ionice.to_class_param passes Other x directly as the -n argument. No range validation is performed - valid range is 0-7 but negative and extreme values are accepted. Kernel behavior with out-of-range ionice values is undefined. Changes take effect immediately without VBD replug.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can pass arbitrary integer values to the Linux ionice binary via the class key in VBD.qos_algorithm_params. The qos_class parser at xapi_xenops.ml:595-600 accepts any integer via Other(int_of_string s), and Ionice.to_class_param passes Other x directly as the -n argument. No range validation is performed - valid range is 0-7 but negative and extreme values are accepted. Kernel behavior with out-of-range ionice values is undefined. Changes take effect immediately without VBD replug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0060"
        }
      ],
      "title": "Arbitrary Integer Passthrough to ionice via VBD.qos_algorithm_params"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0060"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0060",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0072

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    SR Scan Interval Manipulation via Host.other_config auto-scan-interval
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting 0.001 causes continuous SR scanning (CPU/IO exhaustion); setting 999999999 effectively disables scanning (storage state blindness). The field has no map_keys_roles entries for infrastructure keys.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the SR scanning interval by writing an arbitrary float value to Host.other_config:auto-scan-interval. The value is read at xapi_sr.ml:166-168 with float_of_string and no range validation. Setting 0.001 causes continuous SR scanning (CPU/IO exhaustion); setting 999999999 effectively disables scanning (storage state blindness). The field has no map_keys_roles entries for infrastructure keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0072"
        }
      ],
      "title": "SR Scan Interval Manipulation via Host.other_config auto-scan-interval"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0072"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0072",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0054

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    MAC Address Collision via VM.other_config mac_seed
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can cause MAC address collisions by setting the mac_seed key in VM.other_config to a value copied from another VM. The MAC generation algorithm in xapi_vif_helpers.ml uses this seed deterministically. Pool-level duplicate detection exists but only runs during pool join and import, not during direct other_config writes. MAC collisions cause network connectivity failures, ARP table corruption, and traffic misdirection.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can cause MAC address collisions by setting the mac_seed key in VM.other_config to a value copied from another VM. The MAC generation algorithm in xapi_vif_helpers.ml uses this seed deterministically. Pool-level duplicate detection exists but only runs during pool join and import, not during direct other_config writes. MAC collisions cause network connectivity failures, ARP table corruption, and traffic misdirection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0054"
        }
      ],
      "title": "MAC Address Collision via VM.other_config mac_seed"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0054"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0054",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0066

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Metadata Propagation via VDI Snapshot and Clone Operations
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can poison VDI.xenstore_data before a snapshot or clone operation, causing malicious data to propagate to all descendant VDI records. The snapshot/clone code at xapi_vdi.ml:861-862 copies the parent xenstore_data to the new VDI without re-validation. A single injection fans out through the entire hierarchy. The propagation is permanent - removing the injection from the parent does not clean existing descendants.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can poison VDI.xenstore_data before a snapshot or clone operation, causing malicious data to propagate to all descendant VDI records. The snapshot/clone code at xapi_vdi.ml:861-862 copies the parent xenstore_data to the new VDI without re-validation. A single injection fans out through the entire hierarchy. The propagation is permanent - removing the injection from the parent does not clean existing descendants."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0066"
        }
      ],
      "title": "Metadata Propagation via VDI Snapshot and Clone Operations"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0066"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0066",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0083

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Boot Order Manipulation via VM.HVM_boot_params order
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set an arbitrary boot order string in VM.HVM_boot_params:order. The value is passed verbatim to QEMU as the -boot order argument at device.ml:3957-3958. XAPI performs no validation beyond replacing empty values with the default. QEMU ignores unrecognized characters, limiting impact to forcing PXE network boot when the attacker controls DHCP/PXE infrastructure. The field has zero map_keys_roles entries.
    Severity
    3.1 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set an arbitrary boot order string in VM.HVM_boot_params:order. The value is passed verbatim to QEMU as the -boot order argument at device.ml:3957-3958. XAPI performs no validation beyond replacing empty values with the default. QEMU ignores unrecognized characters, limiting impact to forcing PXE network boot when the attacker controls DHCP/PXE infrastructure. The field has zero map_keys_roles entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0083"
        }
      ],
      "title": "Boot Order Manipulation via VM.HVM_boot_params order"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0083"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0083",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0006

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Storage Migration Redirection via VDI.other_config maps_to
    Summary
    The maps_to key in VDI.other_config in XAPI-based hypervisors (XenServer, XCP-ng) is used during cross-pool migration to map local VDIs to remote destinations. An attacker with root access (via BOC-1) can modify maps_to in the XAPI database mid-migration, redirecting disk operations to an attacker-controlled VDI. The import code reads the modified value via Ref.of_string() with no validation, enabling cross-tenant data exfiltration and data corruption during live migration.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    8.8 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The maps_to key in VDI.other_config in XAPI-based hypervisors (XenServer, XCP-ng) is used during cross-pool migration to map local VDIs to remote destinations. An attacker with root access (via BOC-1) can modify maps_to in the XAPI database mid-migration, redirecting disk operations to an attacker-controlled VDI. The import code reads the modified value via Ref.of_string() with no validation, enabling cross-tenant data exfiltration and data corruption during live migration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0006"
        }
      ],
      "title": "Storage Migration Redirection via VDI.other_config maps_to"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0006"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0006",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0008

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Storage Driver Domain PBD Detach DoS via VM.other_config
    Summary
    A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD's SR and sets the PBD's currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM's lifecycle.
    Severity
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
    8.4 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can inject a PBD reference into VM.other_config:storage_driver_domain. When the VM is shut down, XAPI calls Storage_access.reset on the referenced PBD\u0027s SR and sets the PBD\u0027s currently_attached field to false, clearing internal storage state. When the VM starts, XAPI forces a PBD plug on the injected reference. This enables denial-of-service against arbitrary storage repositories by cycling the injected VM\u0027s lifecycle."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0008"
        }
      ],
      "title": "Storage Driver Domain PBD Detach DoS via VM.other_config"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0008"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0008",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0058

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Xenstore Quota Exhaustion via VM.xenstore_data
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can exhaust a guest domain's xenstore quota by injecting a large number of vm-data/* keys into VM.xenstore_data. Xenstore enforces a per-domain quota shared with guest agent data. When injected data consumes the quota, the guest's own xenstore operations fail, disrupting PV drivers, network configuration, and guest agent communication. The field has zero map_keys_roles entries and no value length limits.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can exhaust a guest domain\u0027s xenstore quota by injecting a large number of vm-data/* keys into VM.xenstore_data. Xenstore enforces a per-domain quota shared with guest agent data. When injected data consumes the quota, the guest\u0027s own xenstore operations fail, disrupting PV drivers, network configuration, and guest agent communication. The field has zero map_keys_roles entries and no value length limits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0058"
        }
      ],
      "title": "Xenstore Quota Exhaustion via VM.xenstore_data"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0058"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0058",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0064

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Database Field Poisoning via VDI.xenstore_data Arbitrary Keys
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary key-value pairs into VDI.xenstore_data, a field designed for SM backend use. The field has zero map_keys_roles, zero write-time validation, and zero sanitization. Injected data persists in the XAPI database and is visible to all API consumers. Downstream systems (backup tools, inventory scanners, orchestration platforms) may trust the values as SM-generated metadata. The xe CLI reports this field as read-only, but programmatic API access bypasses this restriction.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary key-value pairs into VDI.xenstore_data, a field designed for SM backend use. The field has zero map_keys_roles, zero write-time validation, and zero sanitization. Injected data persists in the XAPI database and is visible to all API consumers. Downstream systems (backup tools, inventory scanners, orchestration platforms) may trust the values as SM-generated metadata. The xe CLI reports this field as read-only, but programmatic API access bypasses this restriction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0064"
        }
      ],
      "title": "Database Field Poisoning via VDI.xenstore_data Arbitrary Keys"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0064"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0064",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0023

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Guest Agent Script Execution Enablement via Pool.other_config
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can enable execution of arbitrary scripts within guest VMs by setting Pool.other_config:allow_guest_agent_run_script to true. This enables the guest agent run-script capability pool-wide, allowing the operator to execute commands inside any VM with the guest agent installed. This is a privilege escalation from host-level management to guest-level code execution. The key has no per-key RBAC protection and no write-time validation.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
    8.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
    CWE
    • CWE-862 - Missing Authorization
    • CWE-269 - Improper Privilege Management
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can enable execution of arbitrary scripts within guest VMs by setting Pool.other_config:allow_guest_agent_run_script to true. This enables the guest agent run-script capability pool-wide, allowing the operator to execute commands inside any VM with the guest agent installed. This is a privilege escalation from host-level management to guest-level code execution. The key has no per-key RBAC protection and no write-time validation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0023"
        }
      ],
      "title": "Guest Agent Script Execution Enablement via Pool.other_config"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0023"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0023",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0002

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Storage Protocol Injection via sm_config
    Summary
    A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can write arbitrary key-value pairs to VDI.sm_config and SR.sm_config. These fields store internal storage driver state including VHD chain metadata, GC control flags, and encryption key hashes. XAPI performs zero validation and never notifies the storage backend. SM drivers consume the attacker's data as authoritative internal state, turning the hypervisor into a silent proxy that forwards corrupted commands to the storage subsystem through the trusted management channel. Seven exploitation scenarios are confirmed with live evidence including VHD chain severance, SR-wide crash, GC misdirection, and storage saturation.
    Severity
    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    8.6 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can write arbitrary key-value pairs to VDI.sm_config and SR.sm_config. These fields store internal storage driver state including VHD chain metadata, GC control flags, and encryption key hashes. XAPI performs zero validation and never notifies the storage backend. SM drivers consume the attacker\u0027s data as authoritative internal state, turning the hypervisor into a silent proxy that forwards corrupted commands to the storage subsystem through the trusted management channel. Seven exploitation scenarios are confirmed with live evidence including VHD chain severance, SR-wide crash, GC misdirection, and storage saturation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-18T12:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://gna.moksha.dk/MOKSHA-2026-0002"
        }
      ],
      "title": "Storage Protocol Injection via sm_config",
      "x_moksha_patch_status": {
        "blocked_tools": [
          "xe CLI only"
        ],
        "bypassed_methods": [
          "VDI.add_to_sm_config",
          "VDI.set_sm_config",
          "SR.add_to_sm_config",
          "SR.set_sm_config"
        ],
        "unaffected_tools": [
          "XenOrchestra",
          "Python XenAPI bindings",
          "any XMLRPC client"
        ],
        "xsa489_detail": "SMC-1 was never listed as a fixed vulnerability in XSA-489. XSA-489 incidentally marked sm-config as read-only in the xe CLI, but the XMLRPC API bypasses this CLI restriction entirely. SMC-1 remains fully exploitable via direct API calls. Verified 2026-05-18.",
        "xsa489_status": "not_fixed"
      }
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0002"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0002",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-117-2026-0002",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned.",
    "x_moksha_semantic_id": "SMC-1"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "x_gcve": [
    {
      "recordType": "advisory",
      "relationships": [
        {
          "destId": "MOKSHA-2026-0002",
          "type": "equal"
        }
      ],
      "vulnId": "GCVE-117-2026-0002"
    }
  ]
}

    MOKSHA-2026-0045

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Arbitrary Bond Property Injection via PIF.other_config bond-*
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties by writing keys with the bond- prefix to PIF.other_config. The nm.ml module extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property override with zero validation on property names or values. This enables bond mode changes, timer manipulation, and injection of invalid parameters causing OVS errors and network disruption.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary bond configuration properties by writing keys with the bond- prefix to PIF.other_config. The nm.ml module extracts any key with the bond- prefix, strips the prefix, and passes the remainder as a bond property override with zero validation on property names or values. This enables bond mode changes, timer manipulation, and injection of invalid parameters causing OVS errors and network disruption."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0045"
        }
      ],
      "title": "Arbitrary Bond Property Injection via PIF.other_config bond-*"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0045"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0045",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0078

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Guest Clock Manipulation via VDI.other_config timeoffset
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the guest VM's RTC clock by setting the timeoffset key in VDI.other_config. When a VDI has on_boot=reset, the VDI-level timeoffset overrides the VM platform setting during domain creation (xapi_xenops.ml:312-327). No type validation enforces the expected integer format - arbitrary strings are accepted. Corrupted guest clock affects Windows license validation, certificate expiration, Kerberos authentication, and audit trail integrity. The field has no map_keys_roles entries for infrastructure keys.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    2.3 (Low)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-862 - Missing Authorization
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the guest VM\u0027s RTC clock by setting the timeoffset key in VDI.other_config. When a VDI has on_boot=reset, the VDI-level timeoffset overrides the VM platform setting during domain creation (xapi_xenops.ml:312-327). No type validation enforces the expected integer format - arbitrary strings are accepted. Corrupted guest clock affects Windows license validation, certificate expiration, Kerberos authentication, and audit trail integrity. The field has no map_keys_roles entries for infrastructure keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0078"
        }
      ],
      "title": "Guest Clock Manipulation via VDI.other_config timeoffset"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0078"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0078",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0016

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    PVinPVH Xen Kernel Command-Line Injection via VM.platform
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary Xen hypervisor boot parameters into the PVinPVH xen-shim kernel command line by setting VM.platform:pvinpvh-xen-cmdline to an attacker-controlled string. xenopsd reads this value with zero validation and passes it directly to xenguesthelper. The attacker can disable speculative execution mitigations (spec-ctrl=no), remove Meltdown protection (xpti=false), disable L1TF mitigation (pv-l1tf=false), and disable DMA protection (iommu=no) for the affected PVinPVH domain.
    Severity
    7.6 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
    8.5 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject arbitrary Xen hypervisor boot parameters into the PVinPVH xen-shim kernel command line by setting VM.platform:pvinpvh-xen-cmdline to an attacker-controlled string. xenopsd reads this value with zero validation and passes it directly to xenguesthelper. The attacker can disable speculative execution mitigations (spec-ctrl=no), remove Meltdown protection (xpti=false), disable L1TF mitigation (pv-l1tf=false), and disable DMA protection (iommu=no) for the affected PVinPVH domain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0016"
        }
      ],
      "title": "PVinPVH Xen Kernel Command-Line Injection via VM.platform"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0016"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0016",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0012

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    OVS Fail-Mode Denial of Service via Network.other_config
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network denial of service on any OVS bridge by setting Network.other_config:vswitch-controller-fail-mode to secure. In secure fail mode, OVS drops all packets when no SDN controller is reachable. Since most XAPI deployments do not configure an SDN controller, this immediately drops all traffic on the bridge, affecting every VM and management connection on that network.
    Severity
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
    8.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can cause a complete network denial of service on any OVS bridge by setting Network.other_config:vswitch-controller-fail-mode to secure. In secure fail mode, OVS drops all packets when no SDN controller is reachable. Since most XAPI deployments do not configure an SDN controller, this immediately drops all traffic on the bridge, affecting every VM and management connection on that network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0012"
        }
      ],
      "title": "OVS Fail-Mode Denial of Service via Network.other_config"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0012"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0012",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0086

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    License Expiry Manipulation via Host.license_params expiry
    Summary
    An attacker with root access on an XAPI-based hypervisor host (XenServer, XCP-ng) can set the expiry key in Host.license_params to never or a far-future date, preventing license expiry enforcement and suppressing alerts. The license_check.ml code reads this value and treats never as no expiration. The field has the strongest XAPI access control (_R_LOCAL_ROOT_ONLY, pool_internal, DynamicRO). This is a license compliance issue - root access already grants full system control.
    Severity
    2.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
    4.6 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker with root access on an XAPI-based hypervisor host (XenServer, XCP-ng) can set the expiry key in Host.license_params to never or a far-future date, preventing license expiry enforcement and suppressing alerts. The license_check.ml code reads this value and treats never as no expiration. The field has the strongest XAPI access control (_R_LOCAL_ROOT_ONLY, pool_internal, DynamicRO). This is a license compliance issue - root access already grants full system control."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0086"
        }
      ],
      "title": "License Expiry Manipulation via Host.license_params expiry"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0086"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0086",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0009

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    QEMU Serial Host Filesystem Write via VM.platform hvm_serial
    Summary
    A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can create arbitrary files on the host filesystem by setting VM.platform:hvm_serial to file:<path>. XAPI reads this key from the raw database record, bypassing the filtered_flags allowlist, and passes it to QEMU as the -serial argument. QEMU creates the target file as root even if the VM fails to start. This chains into all 34 FIST debug points in XAPI, enabling disablement of HA, memory checks, and other safety mechanisms without requiring BOC-1.
    Severity
    8.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
    8.5 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can create arbitrary files on the host filesystem by setting VM.platform:hvm_serial to file:\u003cpath\u003e. XAPI reads this key from the raw database record, bypassing the filtered_flags allowlist, and passes it to QEMU as the -serial argument. QEMU creates the target file as root even if the VM fails to start. This chains into all 34 FIST debug points in XAPI, enabling disablement of HA, memory checks, and other safety mechanisms without requiring BOC-1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0009"
        }
      ],
      "title": "QEMU Serial Host Filesystem Write via VM.platform hvm_serial"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0009"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0009",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0020

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    CBT Metadata Corruption via VDI.other_config content_id
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt Change Block Tracking (CBT) metadata by injecting a crafted content_id value into VDI.other_config. The content_id key is used by the XAPI storage bridge to track VDI content identity across activate/deactivate/clone cycles. Incremental backup solutions use content_id to determine the base snapshot for changed-block calculations. A forged UUID causes the backup system to use an incorrect base, missing changed blocks and producing backups that silently lose data on restore.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
    CWE
    • CWE-862 - Missing Authorization
    • CWE-20 - Improper Input Validation
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can corrupt Change Block Tracking (CBT) metadata by injecting a crafted content_id value into VDI.other_config. The content_id key is used by the XAPI storage bridge to track VDI content identity across activate/deactivate/clone cycles. Incremental backup solutions use content_id to determine the base snapshot for changed-block calculations. A forged UUID causes the backup system to use an incorrect base, missing changed blocks and producing backups that silently lose data on restore."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0020"
        }
      ],
      "title": "CBT Metadata Corruption via VDI.other_config content_id"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0020"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0020",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0010

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Block Device Path Injection via PBD.device_config
    Summary
    A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. A systemroot check protects the host root device, but does not protect other partitions, additional disks, remote block devices, or other VMs' local storage. Data destruction on arbitrary accessible block devices results.
    Severity
    8.4 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
    8.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:L/SI:L/SA:H
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can inject an arbitrary block device path via PBD.device_config:device when creating an EXT or LVM SR. The SM driver reads the path and passes it to pvcreate and vgcreate, which execute destructive operations on the attacker-chosen device. A systemroot check protects the host root device, but does not protect other partitions, additional disks, remote block devices, or other VMs\u0027 local storage. Data destruction on arbitrary accessible block devices results."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:L/SI:L/SA:H",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0010"
        }
      ],
      "title": "Block Device Path Injection via PBD.device_config"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0010"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0010",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    MOKSHA-2026-0052

    Vulnerability from moksha – Published: 2026-04-24 06:00 – Updated:
    VLAI
    Title
    Leaked VBD Detection Spoofing via task_id/related_to
    Summary
    A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can spoof the task_id and related_to keys in VBD.other_config to evade leaked VBD detection. These keys track which task created a VBD and which control domain it belongs to. By injecting false values, an attacker makes malicious VBDs appear as legitimate control-domain attachments, causing the cleanup subsystem to skip them. VBD.other_config has zero map_keys_roles entries.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    CWE
    References
    Impacted products
    Credits
    Jakob Wolffhechel, Moksha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can spoof the task_id and related_to keys in VBD.other_config to evade leaked VBD detection. These keys track which task created a VBD and which control domain it belongs to. By injecting false values, an attacker makes malicious VBDs appear as legitimate control-domain attachments, causing the cleanup subsystem to skip them. VBD.other_config has zero map_keys_roles entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0052"
        }
      ],
      "title": "Leaked VBD Detection Spoofing via task_id/related_to"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0052"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0052",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}