A critical authentication bypass in Xen Orchestra is being actively exploited, allowing attackers to gain administrator access and potentially take over the XCP-ng virtualization hosts managed through the platform. Vates, the developer of Xen Orchestra, disclosed the flaw in its November 10 security advisory and warned that it is already being used in attacks.
The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance. It stems from how the management platform processes authentication tokens in REST API requests. An attacker who can reach the management interface can send a specially crafted cookie containing an empty JSON object, causing the software to retrieve an existing authentication token and sign the attacker in as its owner without valid credentials.
Once inside, an attacker can retrieve reusable login token IDs through the REST API and perform actions with administrator privileges. Vates warns that a compromise can lead to arbitrary code execution on managed pools and a full takeover of XCP-ng nodes as root. The vendor has not assigned a CVE identifier or CVSS score to the flaw.
Versions of Xen Orchestra earlier than 6.9.2 on the stable channel and 6.10.1 on the latest channel are affected, as are Xen Orchestra Appliance deployments. Vates lists xo-server 5.211.2 as the fixed stable package and 5.213.1 as the fixed latest package. The fixed Xen Orchestra releases are 6.9.2 and 6.10.1.
Vates has published indicators of compromise tied to the known campaign, including connections to attacker-controlled infrastructure, requests containing the crafted authentication cookie, a virtual machine named “pivot2,” and unusual files on affected hosts. The company warns that successful exploitation does not leave a corresponding authentication event in application logs, making HTTP traffic monitoring important for identifying this attack.
The flaw was discovered by Filip Magic and Christoffer Olsen of TDC NET Security. Vates has urged administrators to install the fixed releases and keep the management interface off the public internet. The company also recommends rotating passwords and secrets if an environment may have been compromised.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
