Xen Orchestra Auth Bypass Is Being Exploited. Patch and Wall Off Your XO

If you run XCP-ng with Xen Orchestra, stop and patch. Vates says a critical authentication bypass (VSA-2026-062, no CVE yet) is being exploited.

The bug

Send a crafted authenticationToken cookie holding an empty JSON object and XO grabs an existing token and logs you in as its owner. No password needed. From there an attacker can pull reusable login tokens through the REST API. Vates warns it can lead to code execution on managed pools and “a full XCP-ng node takeover as root.”

What to do

• Update to Xen Orchestra 6.9.1 (stable) or 6.10.0 (latest), with xo-server 5.211.2 or 5.213.1.
• Keep XO on a dedicated management network only. It should never be reachable from the internet.
• After patching, review XO users and tokens and revoke anything you don’t recognize.

God Bless, and May the Source Be with You!

References & Further Reading

• Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers (BleepingComputer)
• Vates security advisory VSA-2026-062 (Vates)
• How-To: Lock Admin Web UIs to Your Own Networks With nginx (EtherNinja)