Xen Orchestra auth bypass exploited: update to 6.9.2 or 6.10.1

If you run XCP-ng and your Xen Orchestra login page is reachable from the internet, assume someone else had admin. Vates disclosed VSA-2026-062 today, a critical Xen Orchestra authentication bypass, and its advisory says a threat actor is already exploiting it. The exploit is one cookie. Admin in Xen Orchestra means root on the hosts it manages.

What actually happened

From the Vates security advisory:

• The bug. Xen Orchestra's REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object, {}. The token lookup treats {} as "no filter" and returns the first token it finds. The attacker is now logged in as that token's owner.
• The follow-up. Once inside, the /rest/v0/users/me/authentication_tokens route hands back reusable login token IDs.
• Impact. Vates says the attacker gets "Admin" privilege, and that can lead to code execution on managed pools and "a full XCP-ng node takeover as root."
• Affected. Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest), and the Xen Orchestra Appliance (XOA). Fixed packages: xo-server 5.211.2 (stable) and 5.213.1 (latest). Source installs should move to latest master.
• No log trail. Vates says a successful exploit leaves no log of the unauthenticated access. You find it in HTTP traffic or by its leftovers: a VM named pivot2, VMs set to hvm_serial: file, and files such as /etc/cron.d/zz-ustar and /.ustar5 on hosts.

No CVE or CVSS score was assigned at publication, per BleepingComputer. Researchers at TDC NET Security found the flaw.

Why it matters for your business

XCP-ng is an open-source hypervisor that smaller IT shops and MSPs run as a VMware alternative. Xen Orchestra is the single pane that runs all of it: every VM, every backup job, every storage credential. One compromised management console is every server you own.

Do this today:

1. Update. Stable channel to 6.9.2, latest channel to 6.10.1. Some early reports gave lower version numbers; go by the Vates advisory.
2. Get XO off the internet. Put it on a management network or behind a VPN. Vates says the same.
3. Run the checks. Vates lists the exact xe and ls commands. If you find anything, rotate every secret XO holds: root and pool secrets, backup remotes (NFS, S3, SMB, Azure), user passwords and OTP seeds. On a confirmed compromise, Vates recommends a full reinstall.

Sources: Vates security advisory VSA-2026-062, BleepingComputer.