NetScaler Console: unauthenticated authentication bypass (CVE-2026-120869)

An unauthenticated remote caller can bypass the NetScaler Console appliance's authentication and reach restricted resources. The advisory notes no user interaction is required, so any appliance exposed to the network is exposed to the bypass.

Public CVE record · Advisory reference · Module source · Source and API bundle

Patch title. NetScaler Console Authentication Bypass Guard (netscaler-console-authentication-bypass-guard in the registry). The original source snapshot preserves the source available for the historical report.

Result. The marked fixture request raised the backend counter in the baseline (200, +1). The declarative tier refused it (403, counter unchanged; benign false positive recorded where the tier-1 deny covers the benign route). The native module refused the advisory-shaped request (403, counter unchanged) while the benign probe stayed HTTP 200, verified against an independent backend counter through Eden 1.103.0.

The vulnerability

Citrix reports that an unauthenticated attacker can bypass Console authentication and access restricted resources. The Eden fixture modeled that outcome with a caller-supplied identity header. The advisory does not attribute the appliance bypass to this header.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/console/ui",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. gabriel_nsconsole_v1 waits for a complete request, matches targets starting with the console UI route, and refuses any request presenting a spoofed console identity header (X-NSC-User). Requests without the spoofed header continue.

const ROUTE: &[u8] = b"/console/ui";
// refuse requests presenting the X-NSC-User identity header

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites and the API example.

1. Prepare the target. Verify the loaded Citrix NetScaler Console version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source.
2. Apply the declaratory policy. Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Save the interlay's complete current settings, place the policy from this report in settings.remediation, and PATCH the full settings object with a fresh Idempotency-Key. Read the interlay back and confirm remediation_status.state is ready.
3. Import and activate the native module. Build the schema-2 archive from the linked source with the compatible SDK, verify its digest, and PUT it to the interlay's patch-packages endpoint. Import requires explicit activation: enroll the publisher key, attest the host inventory, inspect the returned configuration, obtain independent host approval, sign the typed statement, admit, and activate. Read the receipt until serving_now is true and the expected shards are acknowledged. Full command sequences are in the API example.
4. Verify, revoke, and restore. Replay the benign and advisory-shaped probes and compare the backend counter. Revoke the operation and confirm the advisory-shaped request no longer succeeds (fail-closed 503); re-approve, re-admit, and reactivate a replacement operation to restore protection.

Vendor update. Apply the vendor update for the installed release or model. Advisory reference

Fixture and probes

The benign probe fetched a console dashboard unauthenticated. The marked fixture probe fetched a restricted resource presenting the X-NSC-User identity header. The fixture incremented its marker when a spoofed identity header reached the restricted handler. The bypass header and route are fixture-delivered shapes consistent with the advisory's identity-spoof description.

Measured comparison (2026-11-13 UTC)

The values after each status are the observed increases in the fixture's effect counter.

The rule matches the recorded identity-header name on the console route; other bypass vectors (path rewrites, alternate headers) were not exercised. Fixtures deliver the shape honestly because the advisory does not publish the exact bypass route.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the advisory-shaped probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 1d61affa64801487141e05a79d5645a118cf8e4f3f7ab8ce2a16ca11811605aa
• Tested binary SHA-256 84cbdec18dac414a8845b2ee5bce643d896599ab7cec11b602da5c4235c9d98a
• Activation operation 76820557-11bd-46bb-bb76-a765b8ddd4c9

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Test scope

The fixture used an X-NSC-User header on a synthetic console route. Citrix describes unauthorized access but does not identify that header as the cause. The vendor bypass remains unverified.

Evidence and artifacts

• Public CVE record
• Published module source