French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.
The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.
"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the XO token provider without requiring a string."
"The token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs."
In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with "Admin" privileges, ultimately resulting in arbitrary code execution on managed pools and a full XCP-ng node takeover as root.
Vates VMS said it's seeing the vulnerability being actively exploited by a threat actor from the following IP address and TOR domain -
- 91.211.251[.]112:8001, which has been flagged as a RedLine Stealer command-and-control (C2) server on VirusTotal
- ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333
It's unclear when the activity started and if the vulnerability was exploited as a zero-day.
Other indicators of compromise are listed below -
- HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}
- A running virtual machine named pivot2
- Virtual machines configured using "hvm_serial: file" parameter
- Suspicious files named /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6
The issue has been addressed in Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, as well as xo-server versions 5.211.2 and 5.213.1. If immediate patching is not an option, the following mitigations are advised -
- Avoid exposing Xen Orchestra instances on the internet
- Block the IP address and domain associated with malicious activity
- Block the empty token in a web application firewall (WAF) or a reverse proxy
- Rotate all passwords and secrets in Vates VMS if indicators of compromise are detected
Filip Magic (@mad31k) and Christoffer Olsen from TDC NET Security have been credited with discovering and reporting the flaw.
