Title: Attackers Are Bypassing Xen Orchestra Authentication With an Empty Token to Root XCP-ng Nodes
Summary:
Vates VMS published VSA-2026-062 on November 10, 2026, a critical authentication bypass in Xen Orchestra — the management panel for XCP-ng/XenServer pools — that it says is being actively exploited; the flaw has no CVE identifier yet. REST cookie parsing turns authenticationToken=j:%7B%7D into an empty {} object, which REST authentication passes to the XO token provider without requiring a string; the token collection treats {} as an unfiltered lookup and returns its first token, authenticating the attacker as that token’s owner if unexpired, after which the authenticated /rest/v0/users/me/authentication_tokens route hands back reusable login token IDs. The result is an unauthenticated attacker acting with Admin privilege, leading to arbitrary code execution on managed pools and full XCP-ng node takeover as root. Vates reports exploitation from 91.211.251.112:8001 (flagged on VirusTotal as RedLine Stealer C2) and the Tor endpoint ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333, and lists IoCs including HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}, a running VM named pivot2, VMs configured with hvm_serial: file, and files zz-ustar/zz-ustar2 in /etc/cron.d plus /.ustar5 and /.ustar6 — it warns that successful exploitation leaves no log of the unauthenticated access, so watch HTTP traffic. Fixes: Xen Orchestra 6.9.2 (stable) and 6.10.1 (latest), xo-server 5.211.2 (stable) and 5.213.1 (latest). If you cannot patch immediately, do not expose Xen Orchestra to the internet, block the listed C2 addresses and Tor, and add a WAF or reverse-proxy rule against the empty token; on any confirmed compromise, rotate all passwords and secrets (pool secret, backup remotes, root and user accounts, OTP secrets) and reinstall fully, since cleanup alone cannot guarantee removal of attacker backdoors. Discovered and reported by Filip Magic (@mad31k) and Christoffer Olsen of TDC NET Security.
References: