Critical Xen Orchestra flaw lets attackers take over VM servers as root
Vates says the bypass is being exploited now, so administrators running the platform need to patch or cut public exposure without delay.
Vates has disclosed that a critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062, is being exploited in live attacks. A crafted authenticationToken cookie containing an empty JSON object causes the platform to return an existing token and log the attacker in as its owner, granting Admin rights and, in turn, the ability to run code on managed pools and take over XCP-ng hosts as root. Vates says the flaw is fixed in Xen Orchestra 6.9.1 and 6.10.0 along with xo-server 5.211.2 and 5.213.1, though one report describes later fixed releases of 6.9.2 and 6.10.1, so administrators should confirm the version they run. Operators who cannot patch at once should keep the platform off the public internet, block the listed IP and onion address, and filter the empty token at a WAF or reverse proxy. A second flaw enabling malicious VM imports has been exploited too, and a fix for it is still in development.
Why it matters
The flaw lets an unauthenticated attacker gain Admin rights and reach the hosts that run virtual machines, so anyone who depends on a Xen Orchestra deployment for managing servers is directly exposed. Because unauthorized access leaves no log entries, affected operators cannot rely on audit trails to know whether they were compromised and must watch HTTP traffic instead. A second flaw enabling malicious VM imports has also been exploited, and no fix for it has been released yet, so the risk does not end once the authentication bypass is patched.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.