Active Xen Orchestra flaw opens path to XCP-ng host takeover

Vates has confirmed active exploitation of a critical Xen Orchestra authentication bypass, giving remote attackers with network access to the management interface a route to administrator privileges and takeover of XCP-ng virtualization hosts.

At the management interface, the attack starts with a deceptively simple cookie: authenticationToken=j:%7B%7D, an encoded empty JSON object. Xen Orchestra, the web-based platform from French software company Vates for managing XCP-ng virtual machines, hosts and pools, can retrieve an existing authentication token and log the attacker in as its owner without requiring credentials.

Tracked as VSA-2026-062, the flaw affects Xen Orchestra and the Xen Orchestra Appliance (XOA). It sits in how the platform processes authentication tokens sent through REST API requests. Vates had not assigned a CVE identifier or CVSS score when it issued the security advisory.

After authentication, an attacker can retrieve “reusable login token IDs” through the /rest/v0/users/me/authentication_tokens REST API endpoint. Those IDs can support further access.

“An adversary can bypass authentication and perform actions with ‘Admin’ privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root,” Vates warned.

The warning defines the scale: one exposed management interface can put managed pools and the XCP-ng node at risk. Administrators may be maintaining virtual servers while an intruder holds the administrative layer capable of executing code and taking a host as root.

Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the vulnerability.

What should XCP-ng administrators do now?

Patch first. Vates has released Xen Orchestra 6.9.1 on the stable branch and 6.10.0 as the latest release. The releases include patched xo-server packages 5.211.2 and 5.213.1. Administrators should install an update immediately; if they cannot, they should restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses.

This is an active incident, not merely theoretical exposure. Network restriction is a fallback, not a substitute for the vendor’s fix.

Indicators for the known campaign

Vates supplied indicators of compromise for the activity it has observed:

• Connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
• HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}.
• A virtual machine named pivot2.
• VM configurations using the hvm_serial: file parameter.
• Unusual files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6.

The indicators cover network infrastructure, request content, VM names, configuration changes and files on the host. That mix reflects a compromise that can move from the management plane into virtualization infrastructure, rather than remaining a single failed login.

Vates recommends running three checks on XCP-ng hosts:

xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'
zgrep -- '-serial file:' /var/log/xensource.log*
ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*

The first command looks for VMs whose configuration redirects the serial port to a file; the second searches Xen source logs for that serial configuration; the third looks for preload, hidden .ustar and cron artifacts.

There is a catch for incident teams. Vates warns that exploitation will not generate identifiers in logs, including use of the specially crafted cookies. HTTP monitoring is therefore required to spot the malicious requests; log review alone will not confirm them.

The indicators belong only to the known campaign and may differ for other threat actors. Companies that suspect compromise should rotate passwords and secrets used in their virtualization environments.

Patch Xen Orchestra now, then use HTTP monitoring and the campaign indicators to assess whether the management plane and its hosts require credential rotation.