Executive brief
XAPI is a management interface used to control Xen-based virtualization environments. A security flaw in its role-based access control (RBAC) system allows users with limited administrative permissions to bypass restrictions and gain access to sensitive host hardware. This could allow an attacker to escalate their privileges to full system administrator, potentially compromising the entire virtualization pool and its data.
Technical details
A vulnerability exists in XAPI's Role Based Access Control (RBAC) implementation (CWE-250). While configuration of PCI passthrough is intended to be restricted to the highly privileged 'pool-admin' role, a specific API endpoint failed to enforce this check. This allows an authenticated user with the 'vm-admin' role to configure PCI passthrough to unintended host hardware. By gaining direct access to host hardware, a lower-privileged administrator can escalate their privileges to 'pool-admin' (root-equivalent). The issue is resolved in XAPI releases v26.1.11 and v26.12.0.
Affected products
- Xen Project XAPI All versions prior to v26.1.11 and v26.12.0
Timeline
- 2026-04-28: disclosed: Initial public disclosure of XSA-489
- 2026-04-29: patched: Fixes merged and backported in XAPI releases
- 2026-07-09: advisory: NVD publication date