{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "cveId": "MOKSHA-2026-0002",
    "assignerOrgId": "moksha.dk",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned.",
    "state": "PUBLISHED",
    "datePublished": "2026-04-24T06:00:00Z",
    "alternateIds": [
      "GCVE-117-2026-0002"
    ],
    "x_moksha_semantic_id": "SMC-1"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "moksha.dk",
        "shortName": "Moksha",
        "dateUpdated": "2026-05-18T12:00:00Z"
      },
      "title": "Storage Protocol Injection via sm_config",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with the vm-admin role in XAPI-based hypervisors (XenServer, XCP-ng) can write arbitrary key-value pairs to VDI.sm_config and SR.sm_config. These fields store internal storage driver state including VHD chain metadata, GC control flags, and encryption key hashes. XAPI performs zero validation and never notifies the storage backend. SM drivers consume the attacker's data as authoritative internal state, turning the hypervisor into a silent proxy that forwards corrupted commands to the storage subsystem through the trusted management channel. Seven exploitation scenarios are confirmed with live evidence including VHD chain severance, SR-wide crash, GC misdirection, and storage saturation."
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL"
          }
        },
        {
          "format": "CVSS",
          "cvssV4_0": {
            "version": "4.0",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H",
            "baseScore": 8.6,
            "baseSeverity": "HIGH"
          }
        }
      ],
      "affected": [
        {
          "vendor": "Cloud Software Group",
          "product": "XenServer",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Vates",
          "product": "XCP-ng",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Input Validation",
              "cweId": "CWE-20",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Missing Authorization",
              "cweId": "CWE-862",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://gna.moksha.dk/MOKSHA-2026-0002"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "x_moksha_patch_status": {
        "xsa489_status": "not_fixed",
        "xsa489_detail": "SMC-1 was never listed as a fixed vulnerability in XSA-489. XSA-489 incidentally marked sm-config as read-only in the xe CLI, but the XMLRPC API bypasses this CLI restriction entirely. SMC-1 remains fully exploitable via direct API calls. Verified 2026-05-18.",
        "bypassed_methods": [
          "VDI.add_to_sm_config",
          "VDI.set_sm_config",
          "SR.add_to_sm_config",
          "SR.set_sm_config"
        ],
        "blocked_tools": [
          "xe CLI only"
        ],
        "unaffected_tools": [
          "XenOrchestra",
          "Python XenAPI bindings",
          "any XMLRPC client"
        ]
      }
    }
  },
  "x_gcve": [
    {
      "vulnId": "GCVE-117-2026-0002",
      "recordType": "advisory",
      "relationships": [
        {
          "destId": "MOKSHA-2026-0002",
          "type": "equal"
        }
      ]
    }
  ]
}