Hackers exploit Xen Orchestra flaw to gain admin access

Vates VMS has warned of a critical authentication bypass flaw in Xen Orchestra, tracked as VSA-2026-062, which is reportedly being actively exploited in the wild. The flaw allows an attacker to bypass authentication by manipulating REST cookies.

Specifically, REST cookie parsing can turn authenticationToken=j:%7B%7D into {}, and the token provider then authenticates using an unexpired, first token found, enabling an attacker to operate with Admin privileges and potentially take full control of managed pools or an XCP-ng node as root. The issue has no CVE identifier yet.

The alert also notes observable indicators of compromise (IOCs), including HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}, a VM named pivot2, VMs configured with the hvm_serial: file parameter, and suspicious files such as /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6.

Vates VMS reports that Xen Orchestra versions 6.9.1 and 6.10.0 for stable and latest channels, and xo-server 5.211.2 and 5.213.1, address the vulnerability. Mitigations include not exposing Xen Orchestra instances to the internet, blocking the associated malicious IP address and onion TOR domain, blocking the empty token with a web application firewall or reverse proxy, and rotating passwords and secrets if indicators of compromise are detected.

The firm credits Filip Magic (mad31k) and Christoffer Olsen from TDC NET Security with discovery and reporting. The disclosure notes that exploitation activity has been observed from specific IP addresses and a TOR domain, but it is unclear when the activity began or whether the flaw was exploited as a zero-day.