Xen Orchestra empty-token bypass exploited; VM-import host flaw still unfixed

Vates says attackers exploited Xen Orchestra, the agentless console for XCP-ng and XenServer, in builds before 6.9.2 stable and 6.10.1 latest, Appliance included. A REST token is turned into an empty object and treated as an unfiltered lookup. The store returns the first token. If it is unexpired, the caller authenticates as its owner and can obtain administrator rights. Reusable login token IDs are exposed on the way through. The same actor then used admin rights against a second flaw, malicious VM imports that can compromise XCP-ng hosts. That fix is still in development. No CVE is assigned.

What the trail shows is a vendor incident note, relayed by SecurityWeek, not a scored vulnerability record. Vates places the observed operator at 91.211.251.112 port 8001 and on Tor, and says the access is not logged. Indicators were shared and explicitly limited to this campaign. Vates also wrote that other actors, with different infrastructure, cannot be ruled out, and that missing indicators do not prove a clean system. This desk has not verified an independent packet-level reproduction. Without a CVE there is no NVD CVSS score to quote. Severity here rests on exploit evidence and blast radius, not a calculator.

Attribution split. The described mechanism is an empty-object lookup that returns the first token, then a privileged VM import aimed at the host. Vates, via SecurityWeek, claims one operator on 91.211.251.112 and Tor. That claim is not a technical identification of a state or a named group. No outside lab has published confirmation. What coverage skips is the logging gap: this route does not record unauthorized access, so missing IoCs and quiet auth logs are not an all-clear. Hunt on the hypervisor and on imported VM metadata, not on failed logins. Empty-object filters are an old failure mode.

The operational target is the control plane. Xen Orchestra spans hosts, VMs, storage, and pools. Vates says compromise can mean arbitrary code on managed pools and root takeover of XCP-ng nodes. That is the estate logic behind ESXi ransomware: own the console, then backups and hypervisors together. Isolation, known-infra blocks, a WAF rule on the empty token, and credential rotation are stopgaps. Vates says a confirmed hit requires full reinstall because cleanup cannot clear backdoors. Versions 6.9.2 and 6.10.1 close the auth bypass and leave the VM-import bug open. Indicator-negative is not clean.