Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]


XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:

https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles

The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.

The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.

Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.

* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.

* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.

* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.

* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.

* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Published: 2026-07-09
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CVE-2026-23559 is a privilege‑escalation flaw in the Xen XAPI component that allows a user with the vm-admin role to set the VBD.other_config:backend-local flag. By doing so, the attacker can treat any file in the host domain (dom0) as a virtual disk image and attach it to a VM under their control, gaining arbitrary read or modify access to the host filesystem. This bypasses the intended isolation that only pool‑admin users should have, and the weakness is a classic elevation‑of‑privilege flaw (CWE‑250).

Affected Systems

The vulnerability affects the Xen XAPI service that is part of XenServer systems. Any deployment that exposes XAPI to users with the vm-admin role and does not include the vendor’s fix is potentially impacted. Specific version ranges are not listed in the advisory, so all releases prior to the vendor’s patch are presumed vulnerable.

Risk and Exploitability

The CVSS score of 9.4 marks this as critical. The EPSS score of < 1% indicates a very low but non‑zero likelihood that the vulnerability will be exploited. It is not listed in the CISA KEV catalog. The likely attack vector is an authenticated XAPI API call from a vm‑admin user, after which the attacker can modify the restricted configuration parameter and install a manipulated virtual disk that grants full control over the host’s filesystem and system configuration.

Generated by OpenCVE AI on August 4, 2026 at 07:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued security patch or upgrade to a XenServer release that includes the fixed RBAC controls
  • Revoke or restrict the vm-admin role for users who do not require it, ensuring least‑privilege permissions and limiting access to backend‑local and other privileged settings
  • Configure and monitor audit logging for XAPI API calls that modify VBD.other_config or VM.other_config, and investigate any unauthorized activity

Generated by OpenCVE AI on August 4, 2026 at 07:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Xen
Xen xapi
Vendors & Products Xen
Xen xapi

Thu, 09 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles The pool-admin role is fully privileged. Notably, users with this role can also SSH into the host as root. The other administrator roles are pool-operator, vm-power-admin and vm-admin, each of which are authorised to configure and manage various aspects of the system. Some settings are inadequately restricted, and can be set by a lower privilege of administrator than expected. * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and turn arbitrary files in dom0 into VDIs (virtual disks) and give said disks to a VM they control. This is an arbitrary read and/or modify of files in dom0. * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain and mark a VM as a system domain. System domains are ignored and left running during certain other host/pool operations, and may be hidden from view in tooling. * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain and mark a VM as the storage domain for a particular host storage connection (PBD). Shutting down the VM can cause the PBD to be erroneously marked as unplugged when it is not. * CVE-2026-23562: Configuration of PCI passthrough is normally restricted to the pool-admin role. However one API was missing this check, allowing a vm-admin access to unintended host hardware. * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial parameter, which should be restricted to the pool-admin role, as it can allow arbitrary dom0 file write.
Title Multiple RBAC issues in XAPI
Weaknesses CWE-250
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Xen Xapi
cve-icon MITRE

Status: PUBLISHED

Assigner: XEN

Published:

Updated: 2026-07-09T16:02:32.186Z

Reserved: 2026-01-14T13:07:36.961Z

Link: CVE-2026-23559

cve-icon Vulnrichment

Updated: 2026-07-09T16:02:28.563Z

cve-icon NVD

Status : Deferred

Published: 2026-07-09T16:16:38.807

Modified: 2026-07-09T17:16:58.487

Link: CVE-2026-23559

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T07:45:05Z

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges