Critical Xen Orchestra authentication bypass (VSA-2026-062) actively exploited to gain admin access and hijack XCP-ng hosts
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 00:01; os links antigos trazem para cá.
Vates, the French software company behind Xen Orchestra, has warned of a critical authentication bypass vulnerability that is being actively exploited in the wild (thehackernews.com). Attackers can use it to gain administrator privileges and take over XCP-ng virtualization hosts (bleepingcomputer.com). The flaw is tracked by the vendor as VSA-2026-062 and did not have a CVE identifier as of the 2026-11-10 reporting (thehackernews.com). Both sources were published on 2026-11-10. Because Xen Orchestra manages virtual machines, hosts and pools, a compromise could expose the whole virtualized environment. The sources do not say how many organizations are affected or who is behind the attacks.
Entenda a falha
A vulnerabilidade
Critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance (XOA), Vates' web management platform for XCP-ng, tracked by the vendor as VSA-2026-062 with no CVE or CVSS score yet. A remote attacker with network access to the management interface needs no credentials: a specially crafted cookie logs them in as the owner of an existing token, with Admin privileges. That can mean arbitrary code execution on managed pools and root takeover of XCP-ng nodes. Fixed in Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), with xo-server 5.211.2 and 5.213.1. Vates confirms active exploitation.
Como funciona
A request reaches the REST API carrying an authentication cookie. The REST cookie parser turns the cookie value into an empty object instead of a string. REST authentication passes that object to the XO token provider without requiring a string. The token collection treats the empty object as an unfiltered lookup and returns its first token. If that token is unexpired, the provider authenticates the caller as the token's owner. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs.
Por que é vulnerável
The root cause is missing type validation: the REST authentication code accepts a parsed object where a token string is expected. Compounding it, the token collection reads an empty object as 'no filter' and returns an arbitrary token instead of rejecting the lookup. So an untrusted cookie value ends up selecting someone else's valid token. The articles do not say why this went unnoticed or detail the code change in the fix. Mitigations while unpatched: do not expose the instance to the internet, restrict it to management networks, block the attacker infrastructure and block the empty token in a WAF or reverse proxy.
Onde está
The articles name the REST cookie parsing, the REST authentication step, the XO token provider, the token collection and the /rest/v0/users/me/authentication_tokens route, but no file, function or commit.
Como foi descoberta
Filip Magic (@mad31k) and Christoffer Olsen of TDC NET Security are credited with discovering and reporting the flaw. Vates published an alert (VSA-2026-062) saying it sees active exploitation by a threat actor, using an IP address flagged on VirusTotal as a RedLine Stealer C2 server and a Tor domain. It is unclear when the activity began or whether it was a zero-day. Indicators include a VM named pivot2, VMs set with 'hvm_serial: file' and cron files such as /etc/cron.d/zz-ustar. Vates warns exploitation leaves no distinctive log entries, so detection relies on HTTP monitoring.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article says a PoC has been published. Vates says the flaw is being exploited in the wild, so a working exploit exists in the attackers' hands, but no public copy is cited. Observed attacks lead to Admin access and code execution on managed hosts. Treat patching as urgent, check exposed instances for the published indicators and rotate passwords and secrets if compromise is suspected.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:16.
Detalhes técnicos
- Xen Orchestra is a web-based management platform developed by Vates and used to manage XCP-ng environments, including virtual machines, hosts and pools (bleepingcomputer.com).
- The vulnerability is an authentication bypass that grants administrator privileges, enabling takeover of XCP-ng hosts (bleepingcomputer.com).
- Vendor advisory identifier: VSA-2026-062. No CVE had been assigned yet (thehackernews.com).
- The sources give no affected or fixed versions, no indicators of compromise and no attribution.
Linha do tempo
-
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
ler a análise desta fonte ocultar
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.
The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.
-
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
ler a análise desta fonte ocultar
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools.