Xen Orchestra authentication bypass exploited to hijack XCP-ng hosts

BleepingComputer reported that Vates has confirmed active exploitation of a critical authentication bypass in Xen Orchestra, its web-based management platform for XCP-ng virtualization environments. The vendor warned that an attacker who bypasses authentication can act with administrator privileges. According to Vates, a compromised Xen Orchestra instance can give an attacker the ability to execute arbitrary code on managed pools and fully take over an XCP-ng node with root access.

The flaw, tracked as VSA-2026-062, impacts both Xen Orchestra and the Xen Orchestra Appliance. No CVE identifier or CVSS score has been assigned. According to the Vates advisory, the issue sits in how the software handles authentication cookies in REST API requests: by sending a cookie set to authenticationToken=j:%7B%7D, an empty JSON object, a remote attacker can cause Xen Orchestra to fetch an existing authentication token and log in as that token's owner without credentials.

After authenticating, the attacker can call the /rest/v0/users/me/authentication_tokens endpoint to collect "reusable login token IDs" for further access. Vates' advisory states: "An adversary can bypass authentication and perform actions with 'Admin' privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root."

Vates has released Xen Orchestra 6.9.1 in the stable channel and 6.10.0 in the latest channel, with patched xo-server versions 5.211.2 and 5.213.1. Administrators should install the update immediately, and if that is not possible, they should restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses, according to the source.

Security researchers Filip Magic and Christoffer Olsen, who work at TDC NET Security, found the vulnerability.

For defenders hunting the current campaign, Vates published indicators of compromise: connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333, HTTP requests carrying authenticationToken=j:%7B%7D or authenticationToken=j:{}, a virtual machine named pivot2, VM configurations with the hvm_serial: file parameter, and the files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6. Vates cautioned that use of the crafted cookie will not appear in logs, so detection depends on HTTP monitoring; the company also said these indicators belong to this known campaign and may not match other attackers. Organizations that suspect compromise should rotate passwords and secrets tied to their virtualization environments.