Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:

https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles

The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.

The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.

Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.

* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.

* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.

* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.

* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.

* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Published: 2026-07-09
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing role‑based access control check in the Xen XAPI allows a vm‑admin user to configure PCI passthrough on the host, a function normally restricted to the pool‑admin role. This misuse of privileges is a classic privilege‑escalation flaw, reflected by CWE‑250 (Use of insufficient privileges). An attacker who controls a vm‑admin account can therefore gain direct access to physical hypervisor and the virtual machines it hosts.

Affected Systems

All installations that use the Xen XAPI component, including XenServer and other Xen‑based hypervisor deployments, are affected. The flaw exists wherever the PCI passthrough API is exposed to clients that possess the vm‑admin role; no specific XAPI version information is required for the vulnerability to exist.

Risk and Exploitability

The flaw has a CVSS base score of 9.4, indicating a severe host‑level privilege escalation. The EPSS score is reported as less than 1 %, suggesting a very low, but non‑zero, probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be network‑oriented through the XAPI interfaces; an attacker who can gain vm‑admin credentials or impersonate such a user can invoke the affected API to gain host hardware access.

Generated by OpenCVE AI on July 29, 2026 at 12:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Xen Server patch from Xenbits XSA-489 that configuration.
  • Reduce or remove the vm‑admin role from the environment, ensuring that only users with the pool‑admin role can configure PCI passthrough, and revoke any unauthorized assignments.
  • Verify that all existing PCI passthrough assignments are owned by pool‑admin users and delete any that are not.

Generated by OpenCVE AI on July 29, 2026 at 12:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Xen
Xen xapi
Vendors & Products Xen
Xen xapi

Thu, 09 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles The pool-admin role is fully privileged. Notably, users with this role can also SSH into the host as root. The other administrator roles are pool-operator, vm-power-admin and vm-admin, each of which are authorised to configure and manage various aspects of the system. Some settings are inadequately restricted, and can be set by a lower privilege of administrator than expected. * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and turn arbitrary files in dom0 into VDIs (virtual disks) and give said disks to a VM they control. This is an arbitrary read and/or modify of files in dom0. * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain and mark a VM as a system domain. System domains are ignored and left running during certain other host/pool operations, and may be hidden from view in tooling. * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain and mark a VM as the storage domain for a particular host storage connection (PBD). Shutting down the VM can cause the PBD to be erroneously marked as unplugged when it is not. * CVE-2026-23562: Configuration of PCI passthrough is normally restricted to the pool-admin role. However one API was missing this check, allowing a vm-admin access to unintended host hardware. * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial parameter, which should be restricted to the pool-admin role, as it can allow arbitrary dom0 file write.
Title Multiple RBAC issues in XAPI
Weaknesses CWE-250
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Xen Xapi
cve-icon MITRE

Status: PUBLISHED

Assigner: XEN

Published:

Updated: 2026-07-10T03:55:42.936Z

Reserved: 2026-01-14T13:07:36.961Z

Link: CVE-2026-23562

cve-icon Vulnrichment

Updated: 2026-07-09T16:16:11.112Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T12:30:03Z

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges