Xen Orchestra flaws exploited to take over XCP-ng nodes

SecurityWeek reports that a critical vulnerability in Xen Orchestra has been exploited to bypass authentication and gain full administrative control over XCP-ng nodes. The flaw affects the REST authentication flow: an authentication token can be transformed to {} and treated as an unfiltered lookup, causing the first token to be returned by token collection. If this token remains valid, an attacker can authenticate as its owner.

Vates warns that Xen Orchestra compromises can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root. The issue impacts Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), as well as Xen Orchestra Appliance, which includes Xen Orchestra.

SecurityWeek also notes a second vulnerability disclosed by Vates, exploited by the same actor with administrator privileges. This flaw enables malicious VM imports that could compromise XCP-ng hosts; a fix is still in development. The threat actor is described as operating initially from 91.211.251[.]112:8001 and via the Tor network. No CVE identifiers have been assigned to these defects.

Vates emphasises that unauthorized access may not be logged but has shared indicators of compromise (IoCs) tied to this campaign, cautioning that IoCs alone cannot confirm absence of compromise. The company recommends isolating Xen Orchestra instances behind a dedicated network, blocking known malicious IPs/domains, applying a WAF rule to block the empty token, and rotating all potentially compromised credentials. In confirmed cases, Vates notes that a full reinstallation may be required, as cleanup alone cannot guarantee removal of backdoors.