Xen Orchestra auth bypass exploited; Vates issues patches and IOC guidance

Vates is warning that a critical authentication bypass in Xen Orchestra is being exploited in the wild, according to BleepingComputer. The flaw, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA), the web-based management platform used for XCP-ng virtualization environments. No CVE identifier or CVSS score had been assigned at the time of the source report.

Confirmed by the advisory: an attacker with network access to the management interface can bypass authentication by sending a specially crafted cookie. The vulnerable path involves how Xen Orchestra handles authentication tokens in REST API requests. By supplying a cookie containing an empty JSON object, such as `authenticationToken=j:%7B%7D` or `authenticationToken=j:{}`, an attacker can cause the platform to retrieve an existing token and log in as that token's owner without credentials. After that, the source says, attackers can obtain reusable login token IDs through the `/rest/v0/users/me/authentication_tokens` REST API endpoint.

Vates warns that successful exploitation can give an adversary `Admin` privileges. The advisory further states that compromise of Xen Orchestra can lead to arbitrary code execution on managed pools and a full takeover of an XCP-ng node as root. The source does not say how many systems have been affected or whether any specific takeover has been confirmed.

Patches are available. Vates has released Xen Orchestra 6.9.1 stable and 6.10.0 latest, including patched `xo-server` packages 5.211.2 and 5.213.1. Administrators should install the update immediately. If patching cannot be done right away, the advisory recommends restricting Xen Orchestra access to dedicated management networks and blocking known malicious IP addresses.

Vates also published indicators of compromise for a known attack campaign. These include connections to `91.211.251.112:8001` or `ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333`; HTTP requests containing the suspicious cookies above; virtual machines configured with the `hvm_serial: file` parameter; and unusual files at `/etc/cron.d/zz-ustar`, `/etc/cron.d/zz-ustar2`, `/.ustar5`, and `/.ustar6`. The advisory points administrators to checks on XCP-ng hosts for unusual VM configurations and malicious files, though the supplied source text did not include the exact commands.

Detection may be difficult. Vates cautions that exploitation may not leave identifiers in logs for the crafted cookie and instead requires HTTP monitoring. The company also notes that the published IOCs are tied to this known campaign and may differ for other threat actors.

Organizations that believe they are compromised should rotate passwords and secrets used by their virtualization environments, according to the advisory. The vulnerability was discovered by Filip Magic and Christoffer Olsen of TDC NET Security.

Interpretation: the management interface should be treated as a high-value control plane, because the source links Xen Orchestra compromise to administrator access and possible root-level host takeover. The confirmed facts are the flaw, the patch releases, Vates' statement that exploitation is active, and the published IOCs. The source does not establish the scale of exploitation or independently verify the campaign beyond Vates' advisory.