--- id: "CMP-202611-csqe25" page: "https://infrastack.ai/live/CMP-202611-csqe25" kind: "campaign" aliases: [] title: "Attackers exploit a Xen Orchestra login bypass (empty login token) to take admin control and root on XCP-ng hosts (Vates fixed in 6.10.0 / 6.9.1, no CVE yet)" severity: "critical" cvss: null epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Xen Orchestra", "fixed": ["6.9.1", "6.10.0"], "affected": "< 6.9.1 (stable), < 6.10.0 (latest); xo-server < 5.211.2 / < 5.213.1", "ecosystem": "vendor"}, {"name": "Xen Orchestra Appliance", "fixed": ["6.9.1", "6.10.0"], "affected": "before 6.9.1 / 6.10.0", "ecosystem": "vendor"}, {"name": "XCP-ng", "fixed": [], "ecosystem": "vendor"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T12:01:31+00:00" updated_at: "2026-11-10T12:02:04+00:00" sources: [{"source": "analyst", "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "first_seen_at": "2026-11-10T12:01:31+00:00", "cites": ["https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"]}] exploit_sources: [] --- # Attackers exploit a Xen Orchestra login bypass (empty login token) to take admin control and root on XCP-ng hosts (Vates fixed in 6.10.0 / 6.9.1, no CVE yet) Link for people: https://infrastack.ai/live/CMP-202611-csqe25 (this .md is for agents) Vates published advisory VSA-2026-062 on 10 Nov 2026: a critical flaw in Xen Orchestra and the Xen Orchestra Appliance lets anyone bypass login with an empty-object token cookie (authenticationToken=j:{}), act as Admin, and from there run code on managed pools and take over XCP-ng hosts as root. Vates says it is being actively exploited by a threat actor working from 91.211.251.112:8001 and a Tor .onion address, who leaves a VM named pivot2 and cron/preload persistence on hosts. Fixed in Xen Orchestra 6.10.0 (latest channel, xo-server 5.213.1) and 6.9.1 (stable channel, xo-server 5.211.2). CVE: unknown. Number of victims and when exploitation began: unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Xen Orchestra affected < 6.9.1 (stable), < 6.10.0 (latest); xo-server < 5.211.2 / < 5.213.1 fixed 6.9.1, 6.10.0 - vendor:Xen Orchestra Appliance affected before 6.9.1 / 6.10.0 fixed 6.9.1, 6.10.0 - vendor:XCP-ng affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a known vulnerability left unpatched (unpatched-vuln). The record describes attackers exploiting a critical Xen Orchestra login-bypass flaw (empty-object token cookie) that Vates has fixed in 6.10.0 and 6.9.1, but it does not say how or whether the incident reached the users, customers or dependents of the affected organisations. How it reached others: not stated (unknown). So it does not happen to you: Your board lists the advisories that are in range for your stack, with the fix version. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unpatched-vuln ## How to check You run Xen Orchestra or the Xen Orchestra Appliance (XOA) older than 6.10.0 (latest) / 6.9.1 (stable), i.e. xo-server older than 5.213.1 / 5.211.2. Successful exploitation leaves no log; watch HTTP traffic to XO for authenticationToken=j:%7B%7D or authenticationToken=j:{}. Look for traffic to 91.211.251.112 (port 8001) or Tor traffic to ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333. In Xen Orchestra, a running VM named pivot2. On XCP-ng hosts: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'; zgrep -- '-serial file:' /var/log/xensource.log*; ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar* (files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6). Vates says missing IoCs do not prove you were not hit. ## Fix Update Xen Orchestra now to 6.10.0 (latest) or 6.9.1 (stable). Until then, keep XO off the internet on a management network, block 91.211.251.112 and Tor traffic, and add a WAF/reverse-proxy rule for authenticationToken=j:{} and j:%7B%7D (Vates warns other encodings can bypass a regex). If XO was reachable or IoCs are found, treat XO and the XCP-ng hosts as compromised and rotate every password and secret Vates VMS uses (proxy, backup, S3, root, user accounts). ## Timeline - 2026-11-10T12:01:31+00:00 analyst https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/ ## Documents - [describes] Critical Xen Orchestra authentication bypass is being actively exploited https://news.ycombinator.com/item?id=50438830 - [describes] VSA-2026-062: Empty-object login token (Xen Orchestra) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_