Executive brief
A vulnerability in the Xen Project's XAPI management tool allows users with limited administrative roles to bypass security restrictions. By incorrectly marking a virtual machine as a 'system domain,' an attacker can hide the machine from management tools and ensure it remains running during maintenance operations. This could allow a malicious user to maintain unauthorized persistence on the server or disrupt standard administrative tasks.
Technical details
A Role-Based Access Control (RBAC) vulnerability exists in XAPI where the 'VM.other-config:is_system_domain' parameter is inadequately restricted. An authenticated user with the 'vm-admin' role can set this flag to mark a Virtual Machine as a system domain, a privilege that should be reserved for 'pool-admin'. Once marked, the VM is ignored by certain host/pool operations and may be hidden from standard management tooling. This allows for unauthorized persistence and potential evasion of administrative oversight. The issue is resolved in XAPI releases v26.12.0 and v26.1.11.
Affected products
- Xen Project XAPI All versions prior to v26.12.0 and v26.1.11
Timeline
- 2026-04-28: disclosed
- 2026-04-29: patched: Fixes merged and backported to XAPI releases.
- 2026-07-09: advisory