Xen Orchestra auth bypass exploited to take over XCP-ng hosts
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
82
- Mentions · 7d1
- Mentions · 30d1
- All mentions1
- First seenNov 10, 2026
- Last mentioned13h ago
Timeline
1 articles · newest firstAppears with
- XCP-ngproduct · 1
- Xen Orchestraproduct · 1
- TDC NET Securityorganization · 1
- xo-serverproduct · 1
- Xen Orchestra Applianceproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.