"An adversary can bypass authentication and perform actions with 'Admin' privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root," warns Vates.
What the bug does and how attackers use it
Vates, the French company that develops Xen Orchestra, says a critical authentication bypass—tracked as VSA-2026-062—allows a remote actor with network access to the management interface to log in as another user without supplying credentials. The flaw arises from how Xen Orchestra processes authentication cookies and REST API tokens. By sending a specially crafted cookie, authenticationToken=j:%7B%7D (an empty JSON object, {{}}), an attacker can force Xen Orchestra to retrieve an existing authentication token and authenticate as its owner.
Once authenticated, an attacker can call the REST API endpoint /rest/v0/users/me/authentication_tokens to enumerate "reusable login token IDs" and use those to extend or deepen access. Vates reports that exploitation can grant administrator privileges and warns of downstream consequences, including arbitrary code execution on managed pools and complete XCP-ng node takeover as root.
Active exploitation and indicators of compromise
Vates confirmed this vulnerability is being actively exploited and published a set of indicators of compromise (IOCs) to help defenders identify affected systems. The IOCs tied to the known campaign include:
- Attacker infrastructure: connections to 91.211.251.112:8001 and orustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
- Suspicious authentication cookies in HTTP requests: authenticationToken=j:%7B%7D or authenticationToken=j:{{}}.
- Virtual machine with name: pivot2.
- Modified VM configurations using hvm_serial: file for serial ports.
- Unusual files present on XCP-ng hosts: /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6.
Vates emphasizes that exploitation does not leave obvious markers in Xen Orchestra logs—specifically, use of the specially crafted cookie will not generate an identifier in the application logs—so detection requires HTTP-level monitoring for the cookie patterns above.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDetection commands and immediate checks for administrators
To help identify compromise on XCP-ng hosts, Vates published a short checklist of commands administrators can run:
- Find VMs configured to use a file for their serial port: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'
- Search XAPI logs for serial-file configuration events: zgrep -- '-serial file:' /var/log/xensource.log*
- Look for malicious files or preload tampering: ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*
Vates also advised that organizations who suspect compromise should rotate passwords and secrets used by their virtualization environments.
Patches released and short-term mitigations
Vates released patched Xen Orchestra builds to address the flaw: Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), which include fixed xo-server packages 5.211.2 and 5.213.1. The company told customers to install updates immediately. When updating is not possible, Vates recommended restricting Xen Orchestra access to dedicated management networks and blocking known malicious IP addresses tied to the campaign.
No CVE identifier or CVSS score had been assigned at the time of Vates' advisory.
Researchers who discovered the vulnerability
The vulnerability was discovered by Filip Magic and Christoffer Olsen of TDC NET Security. Vates published the advisory and the IOCs tied to the observed campaign to assist administrators and incident responders.
What this means for technologists, administrators, and procurement
- Technologists and security teams: watch HTTP logs and web-access patterns for the exact cookie strings authenticationToken=j:%7B%7D or authenticationToken=j:{{}}, and prioritize the xo-server package updates 5.211.2/5.213.1 across affected assets.
- Virtualization administrators: run the supplied xe/zgrep/ls commands to look for the VM named pivot2, VMs with hvm_serial: file, and the unusual files /etc/cron.d/zz-ustar* and /.ustar*, and rotate secrets if compromise is suspected.
- Procurement and IT managers: ensure Xen Orchestra instances are segmented on management-only networks and that patching processes can deploy Xen Orchestra 6.9.1 or 6.10.0 (xo-server 5.211.2 or 5.213.1) promptly in the event of future critical fixes.
Vates' advisory makes clear that this is an immediate operational risk: a simple, malformed cookie can escalate into full administrative control and host takeover. For teams that manage XCP-ng environments, the next steps are concrete—apply the patches, monitor HTTP requests for the cookie patterns, and hunt for the specific IOCs Vates published. The company’s update and the published commands provide a narrow, actionable path to containing the threat; the clock now runs on remediation and detection.
Source: BleepingComputer — Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
