{"id":"CMP-202611-csqe25","kind":"campaign","aliases":[],"related":[],"title":"Attackers exploit a Xen Orchestra login bypass (empty login token) to take admin control and root on XCP-ng hosts (Vates fixed in 6.10.0 / 6.9.1, no CVE yet)","description":null,"summary":"Vates published advisory VSA-2026-062 on 10 Nov 2026: a critical flaw in Xen Orchestra and the Xen Orchestra Appliance lets anyone bypass login with an empty-object token cookie (authenticationToken=j:{}), act as Admin, and from there run code on managed pools and take over XCP-ng hosts as root. Vates says it is being actively exploited by a threat actor working from 91.211.251.112:8001 and a Tor .onion address, who leaves a VM named pivot2 and cron/preload persistence on hosts. Fixed in Xen Orchestra 6.10.0 (latest channel, xo-server 5.213.1) and 6.9.1 (stable channel, xo-server 5.211.2). CVE: unknown. Number of victims and when exploitation began: unknown.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T12:01:31+00:00","products":[{"name":"Xen Orchestra","fixed":["6.9.1","6.10.0"],"affected":"< 6.9.1 (stable), < 6.10.0 (latest); xo-server < 5.211.2 / < 5.213.1","ecosystem":"vendor"},{"name":"Xen Orchestra Appliance","fixed":["6.9.1","6.10.0"],"affected":"before 6.9.1 / 6.10.0","ecosystem":"vendor"},{"name":"XCP-ng","fixed":[],"ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"You run Xen Orchestra or the Xen Orchestra Appliance (XOA) older than 6.10.0 (latest) / 6.9.1 (stable), i.e. xo-server older than 5.213.1 / 5.211.2. Successful exploitation leaves no log; watch HTTP traffic to XO for authenticationToken=j:%7B%7D or authenticationToken=j:{}. Look for traffic to 91.211.251.112 (port 8001) or Tor traffic to ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333. In Xen Orchestra, a running VM named pivot2. On XCP-ng hosts: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'; zgrep -- '-serial file:' /var/log/xensource.log*; ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar* (files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6). Vates says missing IoCs do not prove you were not hit.","fix":"Update Xen Orchestra now to 6.10.0 (latest) or 6.9.1 (stable). Until then, keep XO off the internet on a management network, block 91.211.251.112 and Tor traffic, and add a WAF/reverse-proxy rule for authenticationToken=j:{} and j:%7B%7D (Vates warns other encodings can bypass a regex). If XO was reachable or IoCs are found, treat XO and the XCP-ng hosts as compromised and rotate every password and secret Vates VMS uses (proxy, backup, S3, root, user accounts).","status":"open","published_at":null,"first_seen_at":"2026-11-10T12:01:31+00:00","triaged_at":"2026-11-10T12:01:31+00:00","updated_at":"2026-11-10T12:02:04+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-10T12:03:06Z","path":"unknown","entry":"unpatched-vuln","reason":"The record describes attackers exploiting a critical Xen Orchestra login-bypass flaw (empty-object token cookie) that Vates has fixed in 6.10.0 and 6.9.1, but it does not say how or whether the incident reached the users, customers or dependents of the affected organisations.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-062':50B '-2026':49B '-202611':31A '10':52B '2026':54B '5.211.2':148B '5.213.1':140B '6.10.0':25A,134B '6.9.1':26A,142B '8001':113B '91.211.251.112':112B 'act':79B 'activ':104B 'actor':109B 'address':118B 'admin':13A,81B 'advisori':47B 'anyon':67B 'applianc':65B 'appliance':37A 'attack':1A 'authenticationtoken':77B 'began':157B 'bypass':7A,68B 'campaign':41B 'channel':136B,144B 'cmp':30A 'code':86B 'control':14A 'cooki':76B 'critic':56B 'cron/preload':126B 'csqe25':32A 'cve':28A,149B 'earli':43B 'early-warn':42B 'empti':8A,73B 'empty-object':72B 'exploit':2A,105B,156B 'fix':23A,130B 'flaw':57B 'host':21A,96B,129B 'j':78B 'latest':135B 'leav':120B 'let':66B 'login':6A,9A,69B 'manag':88B 'name':123B 'ng':20A,40A,95B 'nov':53B 'number':151B 'object':74B 'onion':117B 'orchestra':5A,34A,36A,60B,64B,133B 'persist':127B 'pivot2':124B 'pool':89B 'publish':46B 'root':16A,98B 'run':85B 'say':100B 'server':139B,147B 'stabl':143B 'take':12A,91B 'threat':108B 'token':10A,75B 'tor':116B 'unknown':150B,158B 'vate':22A,45B,99B 'victim':153B 'vm':122B 'vsa':48B 'warn':44B 'work':110B 'xcp':19A,39A,94B 'xcp-ng':18A,38A,93B 'xen':4A,33A,35A,59B,63B,132B 'xo':138B,146B 'xo-serv':137B,145B 'yet':29A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["orchestra","orchestraappliance","xcpng","xenorchestra","xenorchestraappliance"],"ptokens":["appliance","ng","orchestra","xcp","xen"],"labels":["campaign","critical","earlywarning","infrastructure"],"campaign_type":"exploitation","search_a":"'-202611':31A '6.10.0':25A '6.9.1':26A 'admin':13A 'appliance':37A 'attack':1A 'bypass':7A 'cmp':30A 'control':14A 'csqe25':32A 'cve':28A 'empti':8A 'exploit':2A 'fix':23A 'host':21A 'login':6A,9A 'ng':20A,40A 'orchestra':5A,34A,36A 'root':16A 'take':12A 'token':10A 'vate':22A 'xcp':19A,39A 'xcp-ng':18A,38A 'xen':4A,33A,35A 'yet':29A","search_b":"'-062':50B '-2026':49B '10':52B '2026':54B '5.211.2':148B '5.213.1':140B '6.10.0':134B '6.9.1':142B '8001':113B '91.211.251.112':112B 'act':79B 'activ':104B 'actor':109B 'address':118B 'admin':81B 'advisori':47B 'anyon':67B 'applianc':65B 'authenticationtoken':77B 'began':157B 'bypass':68B 'campaign':41B 'channel':136B,144B 'code':86B 'cooki':76B 'critic':56B 'cron/preload':126B 'cve':149B 'earli':43B 'early-warn':42B 'empti':73B 'empty-object':72B 'exploit':105B,156B 'fix':130B 'flaw':57B 'host':96B,129B 'j':78B 'latest':135B 'leav':120B 'let':66B 'login':69B 'manag':88B 'name':123B 'ng':95B 'nov':53B 'number':151B 'object':74B 'onion':117B 'orchestra':60B,64B,133B 'persist':127B 'pivot2':124B 'pool':89B 'publish':46B 'root':98B 'run':85B 'say':100B 'server':139B,147B 'stabl':143B 'take':91B 'threat':108B 'token':75B 'tor':116B 'unknown':150B,158B 'vate':45B,99B 'victim':153B 'vm':122B 'vsa':48B 'warn':44B 'work':110B 'xcp':94B 'xcp-ng':93B 'xen':59B,63B,132B 'xo':138B,146B 'xo-serv':137B,145B","search_c":"","cause_entry":"unpatched-vuln","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-10T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-csqe25","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T12:01:31+00:00","fetched_at":"2026-11-10T12:01:31+00:00","note":null,"cites":["https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"]}],"documents":[{"id":114711,"url":"https://news.ycombinator.com/item?id=50438830","title":"Critical Xen Orchestra authentication bypass is being actively exploited","kind":"post","source":"hackernews","publisher":null,"text":"Critical Xen Orchestra authentication bypass is being actively exploited\nhttps://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-10T11:29:43+00:00","relation":"describes","confidence":null,"note":null},{"id":114825,"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","title":"VSA-2026-062: Empty-object login token (Xen Orchestra)","kind":"advisory","source":"analyst","publisher":null,"text":"Critical. Xen Orchestra / Xen Orchestra Appliance. Actively exploited by a threat actor operating from 91.211.251.112:8001 and ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333 (Tor). REST cookie parsing turns authenticationToken=j:%7B%7D into {}; token provider does unfiltered lookup and authenticates as first unexpired token owner; /rest/v0/users/me/authentication_tokens returns reusable token IDs. Admin auth bypass; can lead to code execution on managed pools and root on XCP-ng hosts. Affected: xo-server before 5.213.1 and 5.213.2 in Xen Orchestra before 6.9.1 (stable) and 6.10.0 (latest); XOA affected. Detection: HTTP requests with authenticationToken=j:%7B%7D or authenticationToken=j:{} (no log of unauthenticated access); pivot2 VM; XCP-ng: VMs with hvm_serial: file (xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'), zgrep -- '-serial file:' /var/log/xensource.log*, files /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, /.ustar6, /etc/ld.so.preload. Mitigation: do not expose XO to the internet, block 91.211.251.112 and Tor, WAF rule for the empty token, rotate all Vates VMS passwords and secrets if compromised. Fixed: Xen Orchestra 6.10.0 (latest, xo-server 5.213.1) and 6.9.1 (stable, xo-server 5.211.2) on 2026-11-10. Credits Filip Magic and Christoffer Olsen (TDC NET Security). PR #10748.","published_at":"2026-11-10T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}