Skip to main content

VSA-2026-058: Multiple RBAC issues (CVE-2026-102706, CVE-2026-102707, CVE-2026-102708, CVE-2026-119779, CVE-2026-119780 / XSA-530)

Published Updated Severity CVSS 4.0 Affected products
2026-11-10 2026-11-10 🟠 Moderate Not available yet - XCP-ng 8.3
info

The Xen Project has disclosed multiple vulnerabilities in the Role Based Access Control (RBAC) implementation of XAPI. An authenticated user already granted one of pool-operator, vm-power-admin or vm-admin can escalate their privilege to pool-admin. For Vates products, we classify the impact as Moderate. For details on how we assign severity levels, see our Severity Levels Explained page.

Summary​

XAPI can configure different users with different roles, using Role Based Access Control. XSA-489 identified some inadequately restricted settings, and introduced per-key restrictions. Additional API calls have been identified which were not covered.

  • CVE-2026-102706: Via a crafted VM.create, VM.clone or VM.import call a vm-admin can set restricted VM.other_config, VM.platform, VM.ha_restart_priority and VM.appliance fields.
  • CVE-2026-102707: Via a Network.create call a vm-admin can set restricted Network.other_config and Network.bridge fields.
  • CVE-2026-102708: A vm-power-admin can use the PUT /messages API with a crafted message body allowing for arbitrary dom0 symlink/mkdir as root.
  • CVE-2026-119779: Any authenticated role can force-fail arbitrary tasks via the task_id parameter.
  • CVE-2026-119780: A pool-operator can use a crafted repository_proxy_url to inject arbitrary yum/dnf .repo directives, potentially allowing for a bypass of repository GPG checking.

Impact​

An authenticated user already granted one of pool-operator, vm-power-admin or vm-admin can escalate their privilege to pool-admin.

Any authenticated user, even with the read-only role, can cause tasks of more privileged roles to fail.

The vulnerability is only exposed if RBAC is configured for the pool, and certain users are assigned the not-fully-privileged administrator roles.

info

Vates does not recommend using the XAPI RBAC system: Xen Orchestra manages its own users and does not rely on it. Pools that do not use XAPI RBAC are not exposed to these vulnerabilities.

Status​

  • Released

Affected Versions​

  • XCP-ng 8.3: Affected.

Mitigation​

Disable any users (RBAC subjects) which have been configured with the read-only, vm-operator, vm-admin, vm-power-admin or pool-operator role.

Resolution​

warning

An xe-toolstack-restart is needed for this to take effect.

As of 2026-11-10, the xapi package for XCP-ng 8.3 has been updated to address this issue.

List of packages fixing this issue:

  • XCP-ng 8.3:
    • xapi-26.1.21-1.4.xcpng8.3

Credits​

CVE-2026-102706 and CVE-2026-102707 were discovered by Yuliang Xiao. Thanks to the Xen Project and the XAPI team for their work on these vulnerabilities and the patches to fix them.

References​