Overview
A critical authentication bypass in Xen Orchestra is being actively exploited, according to vendor Vates (advisory VSA-2026-062). Attackers can gain administrator privileges and take over XCP-ng virtualization hosts. At the time of reporting, no CVE ID or CVSS score had been assigned.
The Vulnerability
A crafted authentication cookie (authenticationToken=j:{}, sometimes URL-encoded) lets a remote attacker with network access to the management interface log in as an existing token owner, with no credentials. From there they can retrieve reusable login tokens through a REST API endpoint and act with Admin privileges, which can lead to code execution on managed pools and root-level takeover of XCP-ng nodes.
Affects Xen Orchestra and the Xen Orchestra Appliance (XOA). The affected version range was not listed in the source article. The issue was found by Filip Magic and Christoffer Olsen of TDC NET Security.
Exploitation leaves no log entries, so detection depends on HTTP traffic monitoring.
Fixed Versions
| Channel | Xen Orchestra | xo-server |
|---|---|---|
| Stable | 6.9.1 | 5.211.2 |
| Latest | 6.10.0 | 5.213.1 |
Indicators of Compromise
Vates published IOCs including a suspicious IP address and an onion address, plus:
- A VM named
pivot2 - VMs with
hvm_serial: fileset - Files such as
/etc/cron.d/zz-ustarand/.ustar5
Refer to the Vates advisory for the full list.
Recommendations
- Update immediately to Xen Orchestra 6.9.1 or 6.10.0 (xo-server 5.211.2 / 5.213.1).
- If you cannot patch, restrict management access to a dedicated network and block known malicious IPs.
- Hunt for the IOCs above on XO and on pool hosts.
- If compromise is suspected, rotate passwords and secrets used by the virtualization environment, and rebuild affected hosts.
- Never expose the XO web interface to the internet.