Xen Orchestra authentication bypass is being exploited to take over XCP-ng hosts
Attackers are actively exploiting a critical authentication bypass in Xen Orchestra, according to BleepingComputer, with the potential to gain administrator privileges and take over XCP-ng virtualization hosts. The flaw affects Xen Orchestra and the Xen Orchestra Appliance, which administrators use to manage virtual machines, hosts and pools.
Vates tracks the issue as VSA-2026-062. The vendor said remote attackers with network access to the management interface can bypass authentication by sending a specially crafted cookie. The cookie contains an empty JSON object, which can cause the platform to retrieve an existing authentication token and log the attacker in as its owner without valid credentials.
According to Vates, an authenticated attacker can obtain reusable login-token IDs through the /rest/v0/users/me/authentication_tokens REST API endpoint. The vendor warned that an intrusion can enable arbitrary code execution on managed pools and a full takeover of an XCP-ng node with root privileges. No CVE identifier or CVSS score has been assigned yet.
Vates released Xen Orchestra 6.9.1 as the stable version and 6.10.0 as the latest version. The releases include xo-server packages 5.211.2 and 5.213.1, which fix the reported security vulnerabilities. Administrators should install the update immediately, the vendor said. If that is not possible, Vates recommends restricting Xen Orchestra to dedicated management networks and blocking known malicious IP addresses.
Vates said security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the vulnerability. The vendor also reported indicators linked to the known campaign, including requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}, a virtual machine named pivot2, and files such as /etc/cron.d/zz-ustar and /.ustar5. Vates cautioned that these indicators may not identify other attackers using the same flaw.
The vendor said the crafted-cookie activity will not produce a corresponding identifier in normal logs, so operators need HTTP monitoring to detect it. Organizations that believe their virtualization environment was compromised should rotate the passwords and secrets used by that environment, according to Vates.