MOKSHA-2026-0071: OVS In-Band Management Disablement via Network.other_config

Advisory IDMOKSHA-2026-0071
Semantic IDNOC-5
Published2026-04-24
CVSS 3.14.9 Medium
CVSS 3.1 VectorAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 4.05.1 Medium
CVSS 4.0 VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
XAPI ObjectNetwork
XAPI Fieldother_config:vswitch-disable-in-band
Entry Rolepool-operator
ResearcherJakob Wolffhechel, Moksha

Affected Products

VendorProductVersions
Citrix / Cloud Software GroupXenServer / Citrix Hypervisorall versions (shared XAPI codebase)
VatesXCP-ng8.3.0

Summary

A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable Open vSwitch in-band management on any OVS bridge by writing vswitch-disable-in-band=true to Network.other_config. The value is passed through network_server.ml:1142-1155 to Ovs.create_bridge, which sets other_config:disable-in-band=true on the OVS bridge via ovs-vsctl. In-band management allows OVS to communicate with an SDN controller through the same network the bridge manages. Disabling it severs SDN controller connectivity when no out-of-band management path exists. The Network.other_config field has no map_keys_roles entries for infrastructure keys - only UI keys (folder, XenCenter.CustomFields.*, XenCenterCreateInProgress) are protected.

Vulnerability Description

Network.other_config is a Map(String, String) field defined at datamodel.ml:1998-2007 with ~writer_roles:_R_POOL_OP. The vswitch-disable-in-band key is consumed by two code paths:

  1. xcp-networkd at network_server.ml:1142-1155 reads the key during bridge creation and passes it to Ovs.create_bridge with ?disable_in_band:Some(Some "true").

  2. openvswitch-config-update plugin at line 118 reads the key and applies it to the OVS bridge configuration.

The data flow:

pool-operator writes Network.other_config:vswitch-disable-in-band = "true"
    |
    v
XAPI stores to database (no validation)
    |
    v
network_server.ml:1142-1155 reads value during bridge creation
    |
    v
Ovs.create_bridge sets other_config:disable-in-band=true on OVS bridge
    |
    v
OVS disables in-band management on the bridge

The key is validated only for "true" or "false" string values in xcp-networkd, but XAPI performs no validation at write time. The impact depends on the deployment: environments relying on in-band SDN controller connectivity lose controller communication when the key is set.

Root Causes

  1. Missing RBAC protection. Network.other_config has no map_keys_roles entries for infrastructure keys. The vswitch-disable-in-band key is writable by any pool-operator.

  2. Missing write-time validation. XAPI stores the value without checking whether disabling in-band management is safe for the network's OVS configuration.

  3. No impact assessment at write time. XAPI does not check whether an out-of-band management path exists before allowing in-band management to be disabled.

  4. set_other_config RBAC bypass. The set_other_config method replaces the entire map atomically and bypasses map_keys_roles per-key checks.

Affected Systems

Directly Affected

Indirectly Affected

Exploitation Scenarios

Scenario Impact Pre-conditions Status
SDN controller disconnection Controller loses connectivity to OVS bridge; flow table not updated pool-operator, OVS bridge with SDN controller, no out-of-band path Source-traced
Combined with NOC-2 fail-mode In-band disabled + fail_mode=secure causes total traffic drop pool-operator, OVS bridge with SDN controller Modeled
BOC-1 chain vm-admin disables in-band management across all bridges via RBAC collapse vm-admin, BOC-1 Source-traced

Chaining Analysis

Detection

Remediation

Short-Term Mitigations

Long-Term Fix

Add map_keys_roles protection. Restrict vswitch-disable-in-band to _R_POOL_ADMIN in datamodel.ml. This prevents pool-operators from modifying OVS management behavior.

Add impact assessment. Before allowing in-band management disablement, verify that an out-of-band management path exists for the SDN controller.

Upstream patches exist. They are held privately pending coordinated disclosure.

Disclosure

Disclosure:

References

Credits

Discovered and reported by Jakob Wolffhechel, Moksha.

Jakob Wolffhechel · Moksha · Copenhagen
jakob@wolffhechel.dk · +45 3170 7337
Published 2026-04-24 08:00 CEST · cna.moksha.dk · shittrix.moksha.dk