A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie.
According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests. By sending a specially crafted cookie (authenticationToken=j:%7B%7D) containing an empty JSON object ({}), attackers can trick the platform into retrieving an existing authentication token and logging them in as its owner, without requiring actual credentials.
Once authenticated, attackers can retrieve "reusable login token IDs" through the /rest/v0/users/me/authentication_tokens REST API endpoint, which can be used for further access. "An adversary can bypass authentication and perform actions with 'Admin' privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root," warns Vates.
The company has released Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), including patched xo-server packages 5.211.2 and 5.213.1 to fix these security vulnerabilities. Administrators should install the update immediately, and if not possible, restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses.
Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the vulnerability.
Exploited in attacks
Vates confirmed that the vulnerability is being actively exploited and shared the following indicators of compromise (IOCs) to help administrators identify attacks:
- Attacker's infrastructure: Connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
- Suspicious authentication cookies: HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}.
- Virtual machines: A VM named pivot2.
- Modified VM configurations: Virtual machines configured with the hvm_serial: file parameter.
- Unusual files: /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6.
Administrators can also run the following commands on XCP-ng hosts to check for unusual VM configurations, virtual machines configured to use a file for its serial port, and malicious files: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file' zgrep -- '-serial file:' /var/log/xensource.log* ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*
However, Vates warns that exploitation will not generate any identifiers in logs, such as the use of specially crafted cookies, and instead must be detected through HTTP monitoring. The company also says these IOCs are only associated with this known attack campaign and may differ for other threat actors. Companies that believe they are compromised should rotate passwords and secrets used by their virtualization environments.
