Attackers Are Walking Into Xen Orchestra Without a Password and Taking Over XCP-ng Hosts. The Fix Is Out
Vates says a critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062, is being actively exploited. A crafted cookie gives an attacker administrator rights and can lead to root control of XCP-ng hosts. Versions 6.9.1 and 6.10.0 fix it.
If your company runs its virtual machines on XCP-ng and manages them through Xen Orchestra, the management console itself is now a target. Vates, the French company behind both products, has confirmed that attackers are exploiting a critical flaw that lets them sign in to Xen Orchestra as an administrator without knowing any password.
This briefing draws on BleepingComputer’s report on the exploited flaw, with additional detail from The Hacker News.
The situation in brief
- What: An authentication bypass in Xen Orchestra and the Xen Orchestra Appliance (XOA), tracked by Vates as VSA-2026-062. No CVE number or CVSS score had been assigned at the time of reporting.
- Status: Actively exploited, according to Vates. It is not clear when the attacks began or whether the flaw was used before a fix existed.
- Worst case: Vates warns that a compromise can lead to arbitrary code execution on managed pools and a full takeover of an XCP-ng node as root.
- Fix: Xen Orchestra 6.9.1 on the stable channel and 6.10.0 on the latest channel, which include xo-server 5.211.2 and 5.213.1.
- Credit: Filip Magic and Christoffer Olsen of TDC NET Security found and reported the bug.
Why a cookie is enough
The problem sits in the way Xen Orchestra’s REST interface reads its authentication cookie. When an attacker sends a cookie whose token value decodes to an empty object instead of a real token string, the software treats it as a search with no filter, picks up the first valid token it holds, and logs the request in as whoever owns that token. From there, an API route hands back reusable login token IDs, giving the intruder a way to keep coming back. Anyone who can reach the management interface over the network can try this.
Signs you may already have been hit
Vates published indicators tied to the campaign it has seen. They include web requests carrying the empty-object authentication cookie, connections to the IP address 91.211.251.112 on port 8001 or to a Tor address on port 3333, virtual machines whose configuration points their serial port to a file (the hvm_serial: file setting), and unexpected files named zz-ustar and zz-ustar2 in /etc/cron.d, plus /.ustar5 and /.ustar6. The Hacker News notes that VirusTotal flags that IP address as a command server for the RedLine information stealer.
Two cautions from Vates matter here. First, the crafted cookie does not show up in the application’s own logs, so spotting it requires monitoring the HTTP traffic itself. Second, these indicators describe one known campaign, and other attackers may leave different traces.
What Vates is telling administrators
- Install the fixed release right away.
- If that cannot happen immediately, keep Xen Orchestra off the internet and reachable only from a dedicated management network.
- Block the published IP address and Tor domain, and, per The Hacker News, block the empty token at a web application firewall or reverse proxy.
- If you find any of the indicators, rotate every password and secret used in the virtualization environment.
What this means for your company
A virtualization manager is a master key: whoever controls it controls every server running underneath it. Even if you do not use this product, the lesson applies to any hypervisor console, backup console or remote management tool. Confirm what version you run, make sure the console is never exposed to the open internet, require access through a VPN or jump host, and log web traffic to it so that a bypass like this one leaves a trail. If you do run Xen Orchestra, treat patching as today’s job and check for the indicators above before assuming you are clean.
Not sure who can reach the consoles that run your servers? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
