--- schema: 1 kind: vulnerability title: "Vates Xen Orchestra (VSA-2026-062): a crafted empty-object login cookie bypasses authentication and is exploited to take over XCP-ng hosts; fixed in xo-server 5.213.1 and 5.211.2, no CVE assigned yet" headline: "Xen Orchestra auth bypass is exploited: Admin and root on XCP-ng hosts; update xo-server to 5.213.1 or 5.211.2" summary: > Vates advisory VSA-2026-062 of 2026-11-10 rates Critical an authentication bypass in Xen Orchestra and the Xen Orchestra Appliance, the web management plane for XCP-ng pools: a login cookie that parses to an empty object authenticates as the owner of the first stored token, giving Admin rights, code execution on managed pools and root on XCP-ng nodes. Vates says a threat actor is actively exploiting it; the fixes are xo-server 5.213.1 (latest channel) and 5.211.2 (stable channel), and no CVE id or CVSS score exists yet. discovered_at: "2026-11-11T03:36:00Z" updated_at: null event_date: "2026-11-10" run_id: 2026-11-11T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, auth-bypass, pre-auth, actively-exploited, patch-available] regions: [global] sectors: [] entities: [] techniques: [T1190, T1550.001, T1053.003] affected_products: ["Xen Orchestra", "XCP-ng"] cves: [] sources: - url: "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/" publisher: "Vates (security advisory VSA-2026-062)" date: "2026-11-10" role: primary - url: "https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/" publisher: "BleepingComputer" date: "2026-11-10" role: corroborating closed_sources: [] evidence: - quote: "This vulnerability is actively exploited by a threat actor" publisher: "Vates" source_url: "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/" - quote: "An adversary can bypass authentication and perform actions with 'Admin' privilege." publisher: "Vates" source_url: "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/" - quote: "In the case of a successful exploitation, there is no log to detect unauthenticated access." publisher: "Vates" source_url: "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/" - quote: "A CVE identifier and CVSS score have not been assigned yet." publisher: "BleepingComputer" source_url: "https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/" verification: single-source sourcing_note: > Vates is first-hand for its own product and states the exploitation; BleepingComputer restates the advisory and adds nothing independent, and no third-party telemetry, victim count or CVE record exists yet. BleepingComputer names releases 6.9.1 and 6.10.0 as the fixed ones where Vates names 6.9.2 and 6.10.1; the xo-server package numbers agree between the two, and the advisory's own numbers are used here. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Update every Xen Orchestra and Xen Orchestra Appliance to xo-server 5.213.1 (latest channel) or 5.211.2 (stable channel) now, and until then keep its web and REST interface off every network but a dedicated management one." - "On every Xen Orchestra instance that was reachable from an untrusted network, search the XCP-ng hosts for the artefacts Vates lists (a VM whose platform parameter binds a file to the serial port, an unexpected VM, cron files written by the actor and the dynamic-linker preload file Vates lists), and where compromise is confirmed reinstall from scratch and rotate every secret the Vates stack held, because Vates says cleanup alone cannot guarantee the removal of backdoors." updates: [] migrated_from: null --- Vates published advisory VSA-2026-062 on 2026-11-10, rated Critical, for Xen Orchestra and the Xen Orchestra Appliance (XOA), the web management plane for XCP-ng pools; no CVE id or CVSS score has been assigned ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/); [BleepingComputer, 2026-11-10](https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/)). Vates says a threat actor is actively exploiting the flaw, that an adversary can bypass authentication and act with Admin privilege, and that a compromise can lead to arbitrary code execution on managed pools and a full takeover of XCP-ng nodes as root ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)). The mechanism, per Vates: the REST cookie parser turns an authenticationToken cookie of j:%7B%7D into an empty object, the REST authentication path hands that object to the token provider without requiring a string, the token lookup treats it as unfiltered and returns the first token, and the provider authenticates as that token's owner if the token has not expired; the authenticated token-listing route then returns reusable login token ids ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)). The attacker needs network reach to the interface and an unexpired first token in the Xen Orchestra token store, and no credentials or user interaction. Xen Orchestra before 6.9.2 (stable) and before 6.10.1 (latest) is affected, and the fixes are xo-server 5.211.2 on the stable channel and 5.213.1 on the latest channel; a source install must move to the latest master ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)). BleepingComputer gives different release numbers, so check the installed xo-server version rather than the release label ([BleepingComputer, 2026-11-10](https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/)). **Exposure:** any Xen Orchestra or XOA instance below those versions whose web or REST port is reachable from an untrusted network; Vates' first mitigation is a dedicated management network, never the internet ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)). **Detection:** a successful exploit leaves no Xen Orchestra log, so the signal is on the wire or at a reverse proxy: HTTP requests whose authenticationToken cookie is an empty JSON object in the encoded or the literal form, and Vates warns that a rule written as a regular expression can be bypassed with other encodings ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)). On the XCP-ng hosts Vates lists a VM that sends its serial console to a file, a VM with an unexpected name, cron files written by the actor and the dynamic-linker preload file, and says these cover only the known campaign, so their absence does not prove a clean host ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)). **Defender takeaway:** update now and take the interface off any untrusted network; for an instance that was exposed, treat the stack as possibly compromised, rotate every secret it held (backup remotes, the root and pool secrets, user and OTP secrets, mail-server passwords) and reinstall where compromise is confirmed ([Vates, 2026-11-10](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)).