{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-23559 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-23559 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-23559 is a critical missing authorization vulnerability in Xen XAPI, published on 9 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-23559 and fix it if it is affected.\n\nWhat it is: CVE-2026-23559 is a critical missing authorization vulnerability in Xen XAPI, published on 9 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-23559 in the wild and no public exploit code.\n\nAffected product: Xen XAPI. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23559/ (Markdown: https://insights.sbomify.com/CVE-2026-23559/index.md)","id":"CVE-2026-23559","markdown":"https://insights.sbomify.com/CVE-2026-23559/index.md","name":"CVE-2026-23559","record":{"aliases":["GHSA-rrrp-hjqw-649m"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["privilege_escalation","data_read","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Xen XAPI","requires_auth":"none","summary":"A vm-admin can exploit missing authorization checks to read or modify arbitrary dom0 files and access host hardware, leading to privilege escalation.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"XEN","cpe":[],"cvss":{"score":9.4,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-250","name":"Execution with Unnecessary Privileges"}],"description":"[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\n\nXAPI can configure different users with different roles, using Role\nBased Access Control.  For more details, see:\n\n   https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles \n\nThe pool-admin role is fully privileged.  Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n   turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n   disks to a VM they control.  This is an arbitrary read and/or modify\n   of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n   and mark a VM as a system domain.  System domains are ignored and\n   left running during certain other host/pool operations, and may be\n   hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n   and mark a VM as the storage domain for a particular host storage\n   connection (PBD). Shutting down the VM can cause the PBD to be\n   erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n   restricted to the pool-admin role.  However one API was missing this\n   check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n   parameter, which should be restricted to the pool-admin role, as it\n   can allow arbitrary dom0 file write.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Multiple RBAC issues in XAPI","id":"CVE-2026-23559","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Multiple RBAC issues in XAPI","id":"CVE-2026-23560"},"packages":[],"prev":{"headline":"grant table v2 race in status page mapping","id":"CVE-2026-23558"},"products":["XAPI"],"published":"2026-07-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-09","vendors":["Xen"]},"summary":"A vm-admin can exploit missing authorization checks to read or modify arbitrary dom0 files and access host hardware, leading to privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-23559/"}