Executive brief
XAPI is a management interface used to configure and control Xen-based virtualization environments. A security flaw in its role-based access control (RBAC) allows users with limited administrative permissions to bypass restrictions and write arbitrary files to the host operating system (dom0). This could allow a low-level administrator to take full control of the entire server, potentially leading to data theft or a complete system takeover.
Technical details
A vulnerability exists in XAPI's Role-Based Access Control (RBAC) implementation where the 'VM.platform:hvm_serial' parameter is inadequately restricted. While this parameter should be reserved for the 'pool-admin' role, it can be modified by users with the lower-privileged 'vm-admin' role. By manipulating this parameter, an authenticated attacker with 'vm-admin' privileges can achieve arbitrary file writes within the privileged management domain (dom0). This effectively allows for privilege escalation from a restricted administrator to a full 'pool-admin' with root-level access to the host. The issue is resolved in XAPI releases v26.12.0 and v26.1.11.
Affected products
- Xen Project XAPI All versions prior to v26.12.0 and v26.1.11
Timeline
- 2026-04-28: disclosed: Initial public disclosure of XSA-489
- 2026-04-29: patched: Advisory updated with fix information
- 2026-07-09: advisory: NVD publication date