CVE-2026-110111 is a High severity (CVSS 7.5) privilege escalation in Xen Orchestra before 6.9.0. Two ESXi import methods lack access checks, and a crafted configuration file can pollute object prototypes so any account inherits administrator rights. Upgrade to 6.9.0, which is the patched version, and review your user accounts for unexpected administrators afterward.
What's affected
The record says Xen Orchestra before 6.9.0 is affected. The GitHub advisory lists affected version 6.7.1 and patched version 6.9.0. The advisory does not list a full range, so check the project release notes for any other version you run. The weakness is CWE-1321, improperly controlled modification of object prototype attributes.
According to the advisory, the methods vm.importFromEsxi and vm.importMultipleFromEsxi are registered with no permission or resolve declaration, so any authenticated user can call them, even an account with no permissions. They make xo-server connect to a host the caller chooses and parse a VMware configuration file from it. The parser can be made to set a property on the shared Object prototype, and accounts created without their own permission field then read the inherited value as admin.
Severity differs by source. The record gives 7.5 (High) and VulnCheck gives 7.7 (High). The advisory is labelled High.
How to check if you're exposed
Check the version in the Xen Orchestra web UI under About, or from the source install.
cd /opt/xen-orchestra && git describe --tags
Adjust the path to match your install. If you use XOA, the appliance shows its version in the same About page. Anything below 6.9.0 should be treated as in range.
Also review your user list. Accounts created through single sign-on often have no explicit permission field, which is the case the advisory calls out. Check for admin level accounts you did not create and for 2FA settings that were changed. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade Xen Orchestra to 6.9.0 or later.
- Restart xo-server after the upgrade so any in-memory pollution from a previous process is cleared.
- Audit user accounts, groups and ACLs for unexpected administrators, and check that two factor settings are still what users configured.
- Restrict who can sign in to Xen Orchestra, and place the management interface on a trusted network or behind a VPN.
- Rotate secrets stored in Xen Orchestra, such as stored credentials and API tokens, if you find signs of misuse.
Why it matters
Prototype pollution turns a small parsing flaw into a global one. A single assignment on the base object changes behavior for every other object in the process, including permission checks that read a missing field and fall back to the inherited value.
Here it combines with missing access control on the import methods. Either problem alone is smaller. Together, any authenticated account can take over the management plane that controls your virtual machines. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
What is the fixed version?
The GitHub advisory lists 6.9.0 as patched.
Does the attacker need an administrator account?
No. The advisory says any authenticated user can reach the import methods, including accounts with no permissions.
Sources
Last reviewed: 18 October 2026.
