Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

Entenda a falha

A vulnerabilidade

Critical authentication bypass in Xen Orchestra, Vates VMS's management platform for XCP-ng, tracked as VSA-2026-062 with no CVE yet. It sits in the REST API authentication path and the token provider. An unauthenticated attacker who can reach the instance sends a specially crafted cookie and acts as an Admin. That leads to arbitrary code execution on managed pools and root takeover of XCP-ng nodes. It is fixed in Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), and in xo-server 5.211.2 and 5.213.1. Vates VMS says it is being exploited in the wild.

Como funciona

A request reaches the REST API with an authentication cookie. The cookie parser decodes its value into an empty object instead of a string. REST authentication hands that object to the XO token provider without checking that it is a string. The token collection treats the empty object as a lookup with no filter and returns the first token it holds. If that token has not expired, the provider authenticates the caller as the token's owner. The authenticated route that lists authentication tokens then returns reusable login token IDs.

Por que é vulnerável

The root cause is missing type validation: the REST authentication code accepts a parsed object where a token string is expected. On top of that, the token collection reads an empty object as 'no filter' and returns an arbitrary token rather than rejecting the lookup. Together, an untrusted cookie value ends up selecting someone else's valid token. The articles do not say why it went unnoticed or describe the code change in the fix. Vates VMS also advises blocking the empty token in a WAF or reverse proxy as a mitigation.

Onde está

The articles name the REST cookie parsing, the REST authentication step, the XO token provider and the /rest/v0/users/me/authentication_tokens route, but no file, function or commit.

Como foi descoberta

Filip Magic (@mad31k) and Christoffer Olsen of TDC NET Security are credited with finding and reporting the flaw. Vates VMS published an alert (VSA-2026-062) saying it sees active exploitation by a threat actor, using an IP address flagged on VirusTotal as a RedLine Stealer C2 server and a Tor domain. It is unclear when the activity started or whether the flaw was exploited as a zero-day. Indicators include cron files such as /etc/cron.d/zz-ustar, a running VM named pivot2 and VMs configured with 'hvm_serial: file'.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 17:15.