Critical authentication bypass and zero-day exploited in Xen Orchestra enabling full XCP-ng root takeover
Vates has reported active exploitation of a critical authentication bypass vulnerability and a zero-day flaw in Xen Orchestra, a management platform for XCP-ng and XenServer virtualization environments. The authentication bypass flaw allows unauthenticated attackers to gain administrator privileges by exploiting the REST authentication token mechanism that improperly handles empty tokens, potentially leading to arbitrary code execution and full root takeover of XCP-ng nodes. Furthermore, the zero-day vulnerability—which requires administrator privileges—is being exploited to import malicious VMs, threatening the host systems, with a patch still under development. The affected versions include Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), including the Xen Orchestra Appliance. No CVE has yet been assigned, and attack infrastructure includes the IP 91.211.251.112 and Tor network. Vates highlights that unauthorized access is not logged and recommends strict network isolation, IP/domain blocking, WAF rules for empty tokens, credential rotation, and full reinstallation upon compromise due to backdoor risks.
Entenda a falha
A vulnerabilidade
Xen Orchestra, the web-based management and backup platform for XCP-ng and XenServer, has a critical authentication bypass in its REST authentication mechanism. An unauthenticated attacker with network access to the service can gain administrator privileges. That can lead to arbitrary code execution on managed pools and a full root takeover of XCP-ng nodes. Affected: Xen Orchestra before 6.9.2 (stable) and before 6.10.1 (latest), including the Xen Orchestra Appliance. A second, unpatched zero-day needs administrator privileges and allows importing malicious VMs that compromise XCP-ng hosts. No CVE has been assigned to either flaw.
Como funciona
A request reaches the REST API carrying an authentication token. The software converts the empty token into {} and treats it as an unfiltered lookup in the token collection. The lookup returns the first token in the collection, and if that token has not expired, the authentication provider authenticates the caller as the token's owner. This also exposes reusable login token IDs. The caller therefore acts as a valid user, possibly an administrator, without presenting any credential. Unauthorized access is not logged.
Por que é vulnerável
The root cause is missing validation of the token value. An empty token becomes an empty filter instead of being rejected, so the lookup matches any token rather than one specific token. The articles do not say why it went unnoticed or describe the fix beyond the fixed releases 6.9.2 and 6.10.1. The cause of the zero-day is not described.
Como foi descoberta
The flaws came to light through exploitation in the wild: Vates reported that one threat actor exploited both the authentication bypass and the zero-day. The attacker initially operated from 91.211.251.112:8001 and via Tor. Vates published indicators of compromise but says they are limited to this campaign and that other actors may use different infrastructure. No CVE has been assigned.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No public proof of concept is mentioned. Per Vates, a threat actor is already using working exploits for both the authentication bypass and the zero-day in real attacks, but no published copy is cited. Urgency is high: update to 6.9.2 or 6.10.1, isolate Xen Orchestra on a dedicated network, block the empty token in a WAF and rotate credentials. Since there is no patch for the zero-day, reinstall after a confirmed compromise.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 14:15.
Detalhes técnicos
The authentication bypass arises from the REST mechanism treating an empty token ({}) as an unfiltered lookup, returning the first token in the collection if not expired, thus allowing attackers to masquerade as valid users with admin rights. This leads to arbitrary code execution on managed pools and full root control of XCP-ng nodes. The zero-day flaw permits malicious VM imports that compromise host integrity, contingent on attacker being admin.
Remediação
The vendor recommends confining Xen Orchestra to dedicated networks, blocking malicious IPs/domains, implementing WAF rules to block empty tokens, rotating credentials potentially exposed, and in the event of confirmed compromise, performing a full reinstallation as cleanup may not suffice. No patch is yet available for the zero-day exploit.
This incident poses a critical threat given the severity of privilege escalation and potential remote code execution involved, combined with ongoing active exploitation and incomplete remediation.
Linha do tempo
-
Critical authentication bypass and zero-day exploited in Xen Orchestra enabling full XCP-ng root takeover
ler a análise desta fonte ocultar
Vates has reported active exploitation of a critical authentication bypass vulnerability and a zero-day flaw in Xen Orchestra, a management platform for XCP-ng and XenServer virtualization environments. The authentication bypass flaw allows unauthenticated attackers to gain administrator privileges by exploiting the REST authentication token mechanism that improperly handles empty tokens, potentially leading to arbitrary code execution and full root takeover of XCP-ng nodes. Furthermore, the zero-day vulnerability—which requires administrator privileges—is being exploited to import malicious VMs, threatening the host systems, with a patch still under development. The affected versions include Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), including the Xen Orchestra Appliance. No CVE has yet been assigned, and attack infrastructure includes the IP 91.211.251.112 and Tor network. Vates highlights that unauthorized access is not logged and recommends strict network isolation, IP/domain blocking, WAF rules for empty tokens, credential rotation, and full reinstallation upon compromise due to backdoor risks.
Technical Details
The authentication bypass arises from the REST mechanism treating an empty token (
{}) as an unfiltered lookup, returning the first token in the collection if not expired, thus allowing attackers to masquerade as valid users with admin rights. This leads to arbitrary code execution on managed pools and full root control of XCP-ng nodes. The zero-day flaw permits malicious VM imports that compromise host integrity, contingent on attacker being admin.Remediation
The vendor recommends confining Xen Orchestra to dedicated networks, blocking malicious IPs/domains, implementing WAF rules to block empty tokens, rotating credentials potentially exposed, and in the event of confirmed compromise, performing a full reinstallation as cleanup may not suffice. No patch is yet available for the zero-day exploit.
This incident poses a critical threat given the severity of privilege escalation and potential remote code execution involved, combined with ongoing active exploitation and incomplete remediation.