Xen Orchestra auth bypass (VSA-2026-062) and unpatched admin-level zero-day exploited for XCP-ng host takeover
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 12/11/2026 00:01; os links antigos trazem para cá.
Fontes: securityweek.com ↗ thehackernews.com ↗ bleepingcomputer.com ↗
A critical authentication bypass vulnerability in Xen Orchestra, tracked by Vates as VSA-2026-062, is being actively exploited, according to reports published on 2026-11-10 (bleepingcomputer.com, thehackernews.com). The flaw lets a remote attacker with network access gain administrator privileges without credentials, leading to arbitrary code execution and root takeover of XCP-ng hosts (bleepingcomputer.com, thehackernews.com). A later report (2026-11-11) says Vates also reports exploitation of a separate zero-day in Xen Orchestra that requires administrator privileges and is used to import malicious VMs that threaten the hosts. No patch exists for that zero-day yet (securityweek.com). The affected versions are Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), including the Xen Orchestra Appliance. No CVE has been assigned yet, and attack infrastructure includes the IP 91.211.251.112 and the Tor network (securityweek.com). Updated Xen Orchestra versions addressing the authentication bypass have been released (bleepingcomputer.com, thehackernews.com). The number of victims and the attribution of the threat actors are still not given.
Entenda a falha
A vulnerabilidade
Xen Orchestra, Vates' web management platform for XCP-ng and XenServer (including the Xen Orchestra Appliance), has a critical authentication bypass tracked as VSA-2026-062, with no CVE or CVSS yet. A remote attacker with network access to the interface needs no credentials and gets Admin privileges, which can lead to code execution on managed pools and root takeover of XCP-ng nodes. SecurityWeek lists Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest) as affected. BleepingComputer and The Hacker News say the fix is in 6.9.1 and 6.10.0 (xo-server 5.211.2 and 5.213.1), so the versions disagree. A second, unpatched zero-day needs admin privileges and allows importing malicious VMs that compromise hosts.
Como funciona
A request reaches the REST API with an authentication cookie. The REST cookie parsing turns a cookie carrying an empty JSON object into {}, and REST authentication hands that object to the XO token provider without requiring a string. The token collection treats {} as an unfiltered lookup and returns its first token. If that token has not expired, the provider authenticates the caller as the token's owner. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs for further access. Per Vates, this access is not logged.
Por que é vulnerável
The root cause is missing input validation: the token provider accepts an object where a string is expected, and the token collection treats an empty filter as a match for any token instead of rejecting it. The articles do not say why this went unnoticed or detail what the fix changes beyond the patched releases. The cause of the second zero-day is not described.
Onde está
The articles point to REST cookie parsing, the XO token provider and token collection, and the /rest/v0/users/me/authentication_tokens endpoint, with fixes shipped in xo-server 5.211.2 and 5.213.1; no files or functions are named.
Como foi descoberta
BleepingComputer and The Hacker News credit Filip Magic and Christoffer Olsen of TDC NET Security with discovering and reporting the flaw. Vates then published an advisory confirming active exploitation by a threat actor. The attacker initially operated from 91.211.251.112:8001 (flagged on VirusTotal as a RedLine Stealer C2, per The Hacker News) and via Tor. It is unclear when the activity started or whether it began as a zero-day. SecurityWeek adds that the same actor used a second, unpatched zero-day. The IoCs cover only this campaign, and other actors may use different infrastructure.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article says a proof of concept was published. The flaw is being exploited in real attacks by a threat actor, so a working exploit exists, but no public copy is cited. Urgency is high: update, keep Xen Orchestra on an isolated network, block the empty token in a WAF or reverse proxy, and rotate credentials. Because unauthorized access is not logged, absent log evidence does not mean a system is clean. Vates recommends a full reinstall after a confirmed compromise.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 00:16.
Detalhes técnicos
- Vulnerability 1, authentication bypass in Xen Orchestra, tracked as VSA-2026-062. The first reports describe the bypass as abusing authentication tokens through specially crafted cookies (bleepingcomputer.com, thehackernews.com). The later report pins it on the REST authentication token mechanism: an empty token (
{}) is treated as an unfiltered lookup and returns the first token in the collection if it has not expired. Attackers can thus masquerade as a valid user with admin rights (securityweek.com). - Vulnerability 2, zero-day: it permits importing malicious VMs that compromise host integrity. It requires the attacker to already hold administrator privileges, which the authentication bypass can provide. It is being exploited and is not yet patched (securityweek.com).
- Prerequisite for the bypass: network access to the Xen Orchestra instance; no prior credentials are needed (bleepingcomputer.com, securityweek.com).
- Impact: administrator privileges, arbitrary code execution on managed pools and root-level takeover of managed XCP-ng hosts and their VMs (bleepingcomputer.com, thehackernews.com, securityweek.com). Xen Orchestra manages XCP-ng and XenServer environments (securityweek.com).
- Affected versions: Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), including the Xen Orchestra Appliance (securityweek.com). No CVE assigned yet (securityweek.com).
- Indicators of compromise: the attack infrastructure includes the IP 91.211.251.112 and the Tor network (securityweek.com). Earlier reports describe indicators only generally: suspicious API requests, malicious IP addresses, altered VM configurations and malicious or suspicious files (bleepingcomputer.com, thehackernews.com).
- Logging gap: Vates highlights that unauthorized access is not logged, so absence of log evidence does not show a system is clean (securityweek.com).
Remediação
- Update Xen Orchestra to the releases from Vates immediately; affected builds are those prior to 6.9.2 (stable) and 6.10.1 (latest) (bleepingcomputer.com, thehackernews.com, securityweek.com).
- No patch is available yet for the zero-day; rely on mitigations until Vates releases one (securityweek.com).
- Confine Xen Orchestra to dedicated, strictly isolated networks, and restrict network access where patching is not immediately possible (bleepingcomputer.com, thehackernews.com, securityweek.com).
- Block the malicious IP (91.211.251.112) and related domains, and add WAF rules that block empty tokens (securityweek.com).
- Rotate credentials that may have been exposed (thehackernews.com, securityweek.com).
- Hunt for unusual API requests, known-malicious source IPs, unexpected changes to VM configurations, unfamiliar or imported VMs and unfamiliar files. Because access is not logged, do not depend on logs alone. Consult the Vates advisory for further IOC values.
- If compromise is confirmed, perform a full reinstallation: cleanup may not suffice because of backdoor risks (securityweek.com).
Relatos divergentes
- Bypass mechanism: bleepingcomputer.com and thehackernews.com (2026-11-10) describe specially crafted or manipulated cookies. securityweek.com (2026-11-11) describes the REST authentication token mechanism mishandling an empty token. The latter is more recent and more technically specific, and cites Vates.
- Scope and patch status: the 2026-11-10 reports mention a single flaw with updated versions released. securityweek.com (2026-11-11) adds a second, unpatched zero-day exploited to import malicious VMs. It does not cite the VSA-2026-062 identifier, so the link between its two flaws and that advisory is not confirmed.
- Versions, CVE and IOCs: the 2026-11-10 reports gave no version numbers or specific IOCs. securityweek.com supplies the affected versions and the IP, and states that no CVE has been assigned.
Linha do tempo
-
Critical authentication bypass and zero-day exploited in Xen Orchestra enabling full XCP-ng root takeover
ler a análise desta fonte ocultar
Vates has reported active exploitation of a critical authentication bypass vulnerability and a zero-day flaw in Xen Orchestra, a management platform for XCP-ng and XenServer virtualization environments. The authentication bypass flaw allows unauthenticated attackers to gain administrator privileges by exploiting the REST authentication token mechanism that improperly handles empty tokens, potentially leading to arbitrary code execution and full root takeover of XCP-ng nodes. Furthermore, the zero-day vulnerability—which requires administrator privileges—is being exploited to import malicious VMs, threatening the host systems, with a patch still under development. The affected versions include Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), including the Xen Orchestra Appliance. No CVE has yet been assigned, and attack infrastructure includes the IP 91.211.251.112 and Tor network. Vates highlights that unauthorized access is not logged and recommends strict network isolation, IP/domain blocking, WAF rules for empty tokens, credential rotation, and full reinstallation upon compromise due to backdoor risks.
Technical Details
The authentication bypass arises from the REST mechanism treating an empty token (
{}) as an unfiltered lookup, returning the first token in the collection if not expired, thus allowing attackers to masquerade as valid users with admin rights. This leads to arbitrary code execution on managed pools and full root control of XCP-ng nodes. The zero-day flaw permits malicious VM imports that compromise host integrity, contingent on attacker being admin.Remediation
The vendor recommends confining Xen Orchestra to dedicated networks, blocking malicious IPs/domains, implementing WAF rules to block empty tokens, rotating credentials potentially exposed, and in the event of confirmed compromise, performing a full reinstallation as cleanup may not suffice. No patch is yet available for the zero-day exploit.
This incident poses a critical threat given the severity of privilege escalation and potential remote code execution involved, combined with ongoing active exploitation and incomplete remediation.
-
Hackers exploit critical Xen Orchestra auth bypass flaw for admin access and full VM takeover
ler a análise desta fonte ocultar
A critical security vulnerability in Xen Orchestra, tracked as VSA-2026-062 and addressed in recent updates, is actively exploited by threat actors. The flaw allows bypassing authentication by manipulating cookies, leading to potential arbitrary code execution and XCP-ng host takeover with root privileges. Indicators include suspicious API requests, malicious IPs, altered VM configs, and suspicious files. Immediate mitigation includes applying patches, network restrictions, and credential rotations.
-
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
ler a análise desta fonte ocultar
A critical authentication bypass vulnerability in Xen Orchestra, affecting versions managed by Vates, is being actively exploited in attacks that can grant administrator privileges and lead to full control of XCP-ng virtualization hosts. The flaw, tracked as VSA-2026-062, allows remote attackers with network access to bypass authentication tokens by sending specially crafted cookies, potentially enabling arbitrary code execution and root access on managed servers. Updated versions of Xen Orchestra have been released to address this security issue, and immediate patching or network restrictions are strongly advised. Indicators of compromise include suspicious API requests, malicious IPs, altered VM configurations, and malicious files.