A critical flaw in the Xen orchestration used for administrator access, which allows XCP-ng to take over the root.
Attackers exploit a critical authentication bypass in Xen Orchestra to gain administrative access. The issue affects the management of XCP-ng environments and can allow full root-level compromise of the host once the control plane is compromised.
This is operationally significant because Xen Orchestra sits at the virtualization management layer. A successful admin takeover does not remain limited to one workload; This can translate to host-level control, broad visibility across a managed infrastructure, and rapid impact on multiple virtual machines.
Open sources - closed narratives.