Vates Xen Orchestra (VSA-2026-062): a crafted empty-object login cookie bypasses authentication and is exploited to take over XCP-ng hosts; fixed in xo-server 5.213.1 and 5.211.2, no CVE assigned yet
Xen Orchestra auth bypass is exploited: Admin and root on XCP-ng hosts; update xo-server to 5.213.1 or 5.211.2
Defender actions
- Update every Xen Orchestra and Xen Orchestra Appliance to xo-server 5.213.1 (latest channel) or 5.211.2 (stable channel) now, and until then keep its web and REST interface off every network but a dedicated management one.
- On every Xen Orchestra instance that was reachable from an untrusted network, search the XCP-ng hosts for the artefacts Vates lists (a VM whose platform parameter binds a file to the serial port, an unexpected VM, cron files written by the actor and the dynamic-linker preload file Vates lists), and where compromise is confirmed reinstall from scratch and rotate every secret the Vates stack held, because Vates says cleanup alone cannot guarantee the removal of backdoors.
Analysis
Vates published advisory VSA-2026-062 on 2026-11-10, rated Critical, for Xen Orchestra and the Xen Orchestra Appliance (XOA), the web management plane for XCP-ng pools; no CVE id or CVSS score has been assigned (Vates, 2026-11-10; BleepingComputer, 2026-11-10). Vates says a threat actor is actively exploiting the flaw, that an adversary can bypass authentication and act with Admin privilege, and that a compromise can lead to arbitrary code execution on managed pools and a full takeover of XCP-ng nodes as root (Vates, 2026-11-10). The mechanism, per Vates: the REST cookie parser turns an authenticationToken cookie of j:%7B%7D into an empty object, the REST authentication path hands that object to the token provider without requiring a string, the token lookup treats it as unfiltered and returns the first token, and the provider authenticates as that token's owner if the token has not expired; the authenticated token-listing route then returns reusable login token ids (Vates, 2026-11-10). The attacker needs network reach to the interface and an unexpired first token in the Xen Orchestra token store, and no credentials or user interaction.
Xen Orchestra before 6.9.2 (stable) and before 6.10.1 (latest) is affected, and the fixes are xo-server 5.211.2 on the stable channel and 5.213.1 on the latest channel; a source install must move to the latest master (Vates, 2026-11-10). BleepingComputer gives different release numbers, so check the installed xo-server version rather than the release label (BleepingComputer, 2026-11-10).
Cited evidence
This vulnerability is actively exploited by a threat actor
An adversary can bypass authentication and perform actions with 'Admin' privilege.
In the case of a successful exploitation, there is no log to detect unauthenticated access.
A CVE identifier and CVSS score have not been assigned yet.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.