Xen Orchestra Authentication Bypass Actively Exploited in Wild
Threat actors are actively exploiting a critical vulnerability inside the Xen Orchestra management platform. Specifically, this severe Xen Orchestra authentication bypass allows attackers to enter virtualization consoles without passwords. Adversaries simply manipulate a browser cookie value to hijack active administrative sessions. Consequently, unauthorized intruders can compromise entire enterprise server clusters within moments. Vates disclosed this critical flaw in security advisory VSA-2026-062 on November 10. Although no CVE identifier or CVSS score exists yet, the vendor assigned its highest severity rating.
Empty JSON Cookie Payload Subverts REST API
The underlying flaw resides within how the platform’s REST API parses authentication cookies. Specifically, sending the crafted cookie value authenticationToken=j:%7B%7D resolves into an empty JSON object. Instead of rejecting the malformed credential, the server passes this empty object to its token lookup engine. Because an empty query removes all search filters, the database automatically returns the first available record. If that retrieved session remains valid, Xen Orchestra authenticates the intruder as that legitimate user. Afterward, attackers query the /rest/v0/users/me/authentication_tokens endpoint to harvest active tokens for persistent access.
Hypervisor Host Compromise and Active Intrusion Indicators
Alarmingly, the security consequences extend far beyond the web management interface. According to the Vates security advisory VSA-2026-062, console compromise enables arbitrary code execution across managed pools. Furthermore, intruders can seize complete root control over underlying XCP-ng hypervisor nodes. Unlike traditional virtual machine escapes, compromising the central console exposes multiple production workloads simultaneously. Researchers Filip Magic and Kristoffer Olsen of TDC NET Security discovered this critical architectural defect.
Vates confirmed active exploitation and published indicators of compromise linked to command server 91.211.251.112:8001. Additionally, investigators identified an associated hidden service operating on the Tor network. To detect breaches, administrators should inspect hosts for a rogue virtual machine named pivot2. Defenders must also check for malicious files at /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6. Finally, security teams should audit XCP-ng system logs for suspicious serial port configurations.
Urgent Patching and Management Network Isolation
To remediate this threat, administrators must upgrade to Xen Orchestra 6.9.1 or 6.10.0 immediately. These releases correspond to xo-server packages 5.211.2 for stable channels and 5.213.1 for latest builds. Because the advisory contains minor version discrepancies, operators should verify installed package numbers carefully. Moreover, Vates urges organizations to remove Xen Orchestra interfaces from the public internet. Teams should isolate management panels inside dedicated administrative networks and block malformed cookies at reverse proxies. Ultimately, immediate patching and strict network segmentation safeguard virtualized infrastructure against total host takeover.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
