Xen Orchestra login bypass is exploited to take over XCP-ng hosts

Xen Orchestra login bypass is exploited to take over XCP-ng hosts

10 November 2026: Vates, the French company behind the XCP-ng virtualisation platform, says an authentication bypass in Xen Orchestra, its management console, is being actively exploited. Advisory VSA-2026-062, rated critical, says an attacker can act as an administrator, run code on managed pools and take over XCP-ng hosts as root. No CVE number has been assigned yet.

An empty object that matches any token

The flaw is in how the REST interface reads its login cookie. A cookie set to authenticationToken=j:%7B%7D is parsed into an empty object, {}, and passed to the token check without being required to be a string. The token store treats an empty object as a query with no filter and returns the first token it holds, and if that token has not expired the request is authenticated as its owner.

From there the attacker can call the route that lists the user's authentication tokens and collect reusable login tokens, then use the console's own powers: administrative actions, code execution on the pools it manages, and root on the hosts. Vates says exploitation leaves no entry in the logs, so detection depends on watching HTTP traffic.

Versions and the conflicting fix numbers

Vates lists Xen Orchestra before 6.9.2 on the stable channel and before 6.10.1 on the latest channel as affected, together with the Xen Orchestra Appliance. BleepingComputer reports the fix as 6.9.1 and 6.10.0; the vendor's own numbers are the ones to rely on, so the safe target is 6.9.2 or 6.10.1 and later. BleepingComputer credits the find to Filip Magic and Christoffer Olsen of TDC NET Security.

Signs of compromise Vates lists

The first attacks came from 91.211.251.112 on port 8001 and from a Tor onion address, and Vates names seven further addresses it has seen. On a compromised system it reports:

• a virtual machine named pivot2, or machines configured with an hvm_serial: file setting
• cron files /etc/cron.d/zz-ustar and /etc/cron.d/zz-ustar2
• files /.ustar5 and /.ustar6

Vates advises keeping Xen Orchestra off the internet on a dedicated management network, blocking the listed addresses and Tor, and adding a web firewall rule against the empty token while noting that a pattern match can be bypassed. Where compromise is confirmed, it says to rotate every secret the console holds, including proxy, backup remote, root, pool, one-time password and mail settings, and recommends a full reinstall. We list 14 products in virtualization software and Vates among our software companies.

Related on TrustList:

• Linux kernel flaw lets a guest VM read and crash its host
• XSA-523: two grant copy flaws let a Xen guest read and write Dom0 memory
• Vates raises €30m from IRIS and Bpifrance, its first outside round

Sources

• Vates: VSA-2026-062, Empty-object login token, 10 November 2026, 10 November 2026
• BleepingComputer: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers, 10 November 2026, 10 November 2026