Nutanix AHV inherits the QEMU and KVM guest-to-host escape surface for its VMs. On top, the Nutanix-specific attack surface is the Controller VM services and the Prism management plane, where authentication, API, and web vulnerabilities have granted cluster control without any guest escape. Nutanix publishes its own security advisories for these.
Nutanix-relevant escape classes:
- QEMU/KVM device-model escapes (VMs)
- CVM service vulnerabilities (storage and cluster services)
- Prism web and API auth and injection flaws (management plane)
Exploitation notes#
- For VM breakouts, use KVM and QEMU known escape exploits.
- Nutanix-specific flaws target the CVM and Prism, often yielding cluster-wide control directly, which is higher impact than a single VM escape.
- CVMs trust one another, so a CVM-service compromise tends to spread across the cluster.