Xen Orchestra auth bypass exploited for admin and root access
Original title: Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
Vates fixed VSA-2026-062, which has no CVE yet, in Xen Orchestra 6.9.1 and 6.10.0 and xo-server 5.211.2 and 5.213.1.
Vates VMS says attackers are exploiting a critical Xen Orchestra authentication bypass tracked as VSA-2026-062. Crafted REST cookies make token lookup return the first unexpired token, granting Admin actions, code execution on managed pools, and root takeover of XCP-ng nodes. Fixes are in Xen Orchestra 6.9.1 and 6.10.0 and xo-server 5.211.2 and 5.213.1. Vates ties activity to 91.211.251.112:8001 and a Tor domain and lists cron and VM indicators.
Unconfirmed: Vates has not said when exploitation began or whether the flaw was a zero-day.
- Empty authenticationToken cookies are treated as an unfiltered token lookup.
- The /rest/v0/users/me/authentication_tokens route can return reusable login token IDs.
- One IP is flagged on VirusTotal as a RedLine Stealer C2 server.
- IOCs include a VM named pivot2 and files zz-ustar2, zz-ustar, .ustar5, and .ustar6.
- If patching is delayed, keep instances off the internet and block the listed infrastructure.
Impact: Admin bypass, pool code execution, and root node takeover
| Product | Affected | Fixed in |
|---|---|---|
| Vates VMS Xen Orchestra | — | 6.9.1 and 6.10.0 |
| Vates VMS xo-server | — | 5.211.2 and 5.213.1 |
- 1.Update Xen Orchestra to 6.9.1 or 6.10.0 and xo-server to 5.211.2 or 5.213.1.
- 2.Do not expose Xen Orchestra to the internet; block the named IP and onion domain.
- 3.If the listed IOCs appear, rotate Vates VMS passwords and secrets.
- Vendors
- Vates VMS
- Products
- Xen Orchestraxo-serverXCP-ng
- Malware
- RedLine Stealer
- Organizations
- TDC NET Security
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion | dLine Stealer command-and-control (C2) server on VirusTotal ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333 It's unclear when the activity started and if the vu |
| ipv4 | 91.211.251.112 | threat actor from the following IP address and TOR domain - 91.211.251[.]112:8001 , which has been flagged as a RedLine Stealer comman |
From the original article
2 min read at thehackernews.com
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.