Xen Orchestra auth bypass exploited to take over XCP-ng hosts
Original title: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
Vates says a critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance, tracked as VSA-2026-062, is being exploited. Remote attackers who can reach the management interface send a crafted cookie, authenticationToken=j:%7B%7D, so the server treats an empty JSON object as an existing token and logs them in as its owner with Admin rights. Compromise can lead to code execution on managed pools and full XCP-ng node takeover as root. No CVE or CVSS score has been assigned. Fixes are in Xen Orchestra 6.9.1 and 6.10.0, with xo-server 5.211.2 and 5.213.1.
Unconfirmed: Vates says the published IOCs match one known campaign and may differ for other attackers.
- Filip Magic and Christoffer Olsen of TDC NET Security found the flaw.
- Attackers can pull reusable login token IDs from /rest/v0/users/me/authentication_tokens.
- Vates cites connections to 91.211.251.112:8001 and an onion address on port 3333.
- IOCs include a VM named pivot2 and files /etc/cron.d/zz-ustar and /.ustar5.
- Exploitation does not log the crafted cookie; detect it with HTTP monitoring.
Impact: Admin access and root takeover of managed XCP-ng hosts
| Product | Affected | Fixed in |
|---|---|---|
| Vates Xen Orchestra | versions before 6.9.1 and 6.10.0 | 6.9.1 (stable) and 6.10.0 (latest) |
| Vates Xen Orchestra Appliance | — | 6.9.1 and 6.10.0 |
| Vates xo-server | — | 5.211.2 and 5.213.1 |
- 1.Install Xen Orchestra 6.9.1 or 6.10.0, including the patched xo-server packages.
- 2.If patching is delayed, limit access to management networks and block known malicious IPs.
- 3.Hunt the published IOCs and rotate virtualization passwords and secrets if compromised.
- Vendors
- Vates
- Organizations
- TDC NET Security
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 91.211.251.112 | identify attacks: Attacker's infrastructure: Connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaoh |
From the original article
2 min read at bleepingcomputer.comA critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.