Vates has warned that attackers are actively exploiting a critical authentication bypass in Xen Orchestra, the web management platform for XCP-ng virtualization pools. The flaw, tracked as VSA-2026-062, lets an unauthenticated attacker act with Admin privileges and can lead to a full takeover of XCP-ng hosts as root.
Vates published the security advisory on November 10, 2026, after lifting an embargo and fast-tracking a patch. No CVE identifier or CVSS score had been assigned as of November 11, and the flaw was not listed in CISA’s Known Exploited Vulnerabilities catalog.
How the empty token bypass works
According to Vates, the REST API cookie parser converts a specially crafted authenticationToken cookie into an empty object instead of a text string. The authentication code passes that object to the token provider without checking its type. The token store then treats the empty object as a lookup with no filter and returns the first stored token, so the request is signed in as that token’s owner if the token has not expired.
From there, an attacker can call an authenticated REST route that returns reusable login token IDs. Vates says a compromised Xen Orchestra instance can lead to arbitrary code execution on managed pools.
The fix in pull request #10748 rejects empty and non-string token IDs before any lookup. The pull request traces the bug to a June 2022 code change that added descriptions to authentication tokens. Vates credits Filip Magic and Christoffer Olsen of TDC NET Security with the discovery.
Affected and fixed Xen Orchestra versions
Vates lists every Xen Orchestra release before 6.9.2 (stable channel) and 6.10.1 (latest channel) as affected, along with the Xen Orchestra Appliance (XOA). The fixed packages are:
xo-server 5.211.2on the stable channel (Xen Orchestra6.9.2)xo-server 5.213.1on the latest channel (Xen Orchestra6.10.1)- The latest
masterbranch for installs built from source, followed by a rebuild and restart ofxo-server
XOA users can upgrade from the XOA Updates page. In a forum announcement, Vates co-founder Julien Fontanet said most deployments are not exposed to the public internet, which greatly reduces the risk, but urged anyone with an internet-reachable instance to act now.
What Vates found in the attacks
Vates ties the exploitation it has seen to a threat actor that operated at first from a server at 91.211.251.112 and a Tor onion service. The advisory lists 8 IP addresses to block for both inbound and outbound traffic. Vates has not said how many customers were compromised or when the attacks began.
The advisory warns that a successful bypass leaves no log entry for the unauthenticated access. It tells administrators to check for:
- A running VM named
pivot2 - VMs configured with a serial console that writes to a file on the host
- Cron files named
zz-ustarorzz-ustar2in/etc/cron.d/, hidden/.ustar5and/.ustar6files, and an unexpected/etc/ld.so.preload
Vates cautions that these checks only cover the campaign it has seen so far, and that a clean result does not rule out a compromise.
A second advisory, VSA-2026-063, explains how the attacker reached the hosts. Xen Orchestra forwards VM imports to the hypervisor with full pool-admin rights without inspecting the import’s settings, so a crafted VM can carry settings that compromise the XCP-ng host. Vates rates that issue Important and says it had no fix as of November 10. Until one ships, Vates advises disabling any non-admin user who holds VM import or network create and update privileges.
On November 11, a home lab user said on the XCP-ng forum that their from-source instance running xo-server 5.213.0 was hit overnight through a reverse proxy. The user said none of the published indicators matched, and described new API tokens, a full configuration export containing host root passwords, and a tiny imported VM used to plant a root cron job and SSH key on the host. BreachNews could not independently verify that report.
Mitigations if patching must wait
Vates recommends updating as soon as possible. Until then, it advises administrators to:
- Remove Xen Orchestra from the internet and place it on a dedicated management network, VPN or IP allow list
- Block the listed IP addresses and Tor traffic
- Block the empty token cookie at a WAF or reverse proxy, noting the rule can be bypassed with other encodings
- Revoke all sessions and API tokens, then rotate XCP-ng host root passwords, the pool secret, proxy and backup remote credentials, user passwords and OTP secrets
For any confirmed compromise, Vates recommends a full reinstallation, since cleanup alone cannot guarantee that every backdoor is gone.
Management planes keep drawing attackers
Virtualization and server management tools remain a favorite target because one foothold can expose every system they control. Recent examples include the Warp Panda VMware ESXi zero-day, the cPanel zero-day that granted admin access without a login and the Plex2Shell attacks on QNAP NAS devices.
Vates says it will update the advisory as new information becomes available.
