Xen Orchestra auth bypass (VSA-2026-062) — Vates: attackers bypass auth via crafted cookie, take over XCP-ng hosts as root (CVE unassigned)
Severity: critical · Patch status: patched · Since 2026-11-10
A critical authentication bypass in Vates' Xen Orchestra (tracked VSA-2026-062, CVE not yet assigned) is being actively exploited. By sending a crafted cookie (authenticationToken=j:{} containing an empty JSON object), remote attackers with network access to the management interface are logged in as an existing token owner with Admin privileges. They can retrieve reusable login token IDs via the REST API, execute arbitrary code on managed pools, and fully take over XCP-ng nodes as root. Exploitation leaves no log identifiers and must be detected via HTTP monitoring; shared IOCs include attacker IPs/onion address, a VM named pivot2, hvmserial: file configs, and ustar cron/preload files. Fixes shipped in Xen Orchestra 6.9.1/6.10.0 (xo-server 5.211.2/5.213.1). Discovered by TDC NET Security researchers Filip Magic and Christoffer Olsen.
What to do
- Update immediately to Xen Orchestra 6.9.1 or 6.10.0 (xo-server 5.211.2/5.213.1)
- If patching is delayed, restrict Xen Orchestra access to dedicated management networks and block 91.211.251.112:8001 and the listed onion endpoint
- Hunt for IOCs: authenticationToken=j:{} cookies, VM named pivot2, hvm_serial: file configs, /etc/cron.d/zz-ustar*, /.ustar*, /etc/ld.so.preload; run xe/zgrep checks on XCP-ng hosts
- Monitor HTTP traffic for exploitation, since crafted cookies generate no log entries
- Rotate passwords and secrets used by the virtualization environment if compromise is suspected
Fixed versions
- Xen Orchestra 6.9.1 (stable), 6.10.0 (latest)
- xo-server 5.211.2, 5.213.1
Sources
All live incidents on Threat Watch
