Skip to main content

VSA-2026-063: Crafted keys through XO vm.import privilege

Published Updated Severity CVSS 4.0 Affected products
2026-11-10 2026-11-10 🔴 Important Not available yet - Xen Orchestra / Xen Orchestra Appliance
info

A vulnerability was discovered in Xen Orchestra that is part of the Xen Orchestra Appliance. We classify the impact as Important. For details on how we assign severity levels, see our Severity Levels Explained page.

Summary​

Xen Orchestra send requests as pool-admin to XAPI, the pool-admin role is fully privileged and allow to configure various aspect of the system and forwards the stream to XAPI without reading or modifying ova.xml. A unprivileged user with vm.import (JSON-RPC), sr/import:vm (REST API), network/action:create or network/action:update privilege can import a raw XVA with crafted following keys as demonstrated in XSA-489 and XSA-530 :

  • VBD.other_config:backend-local
  • VM.other-config:is_system_domain
  • VM.platform:hvm_serial

Many others fields can also be manipulate VM.other_config, VM.platform, VM.ha_restart_priority and VM.appliance.

Status​

  • In progress

Impact​

warning

This path has been abused by a threat actor operating initially from 91.211.251.112:8001 and ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333 (via Tor) using Admin privilege (VSA-2026-62).

A unprivileged user could import a malicious VM (XVA) using a crafted keys parameter to compromise an XCP-ng host.

Affected Versions​

  • Xen Orchestra 6.10.1 and before: Affected.
  • Xen Orchestra Appliance: Affected.

Mitigations​

A mitigation option is available.

Authorized VM import only to Admin user

  1. Disable any users which have been configured with the vm.import, sr/import:vm, network/action:create or network/action:update privilege

Resolution​

As of 2026-11-10, Xen Orchestra and Xen Orchestra Appliance do not include the fix for this issue in the latest channel or the stable channel. Vates actively working on a fix.

Credits​

Thanks Matthias Fetzer for the logs and forensic reports regarding this issue

References​

XSA 489 XSA 530