CriticalCVE
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
The Hacker News·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert.
Key details
- Vates VMS warns of a critical authentication bypass in Xen Orchestra being actively exploited.
- The flaw lets an attacker send a crafted cookie to bypass authentication and gain admin privileges.
- Exploitation can lead to arbitrary code execution on managed pools and full XCP-ng node takeover as root.
- Threat actor uses IP 91.211.251[.]112:8001 and a TOR domain for command and control.
- Patches are available in Xen Orchestra 6.9.1, 6.10.0 and xo-server 5.211.2, 5.213.1.
- Filip Magic and Christoffer Olsen from TDC NET Security discovered and reported the flaw.
Affected
- Xen Orchestra stable channel before 6.9.1 and latest channel before 6.10.0.
- xo-server versions before 5.211.2 and 5.213.1.
Fixes and mitigations
- Block the malicious IP address and TOR domain.
- Block empty token in WAF or reverse proxy.
- Rotate all passwords and secrets if compromise indicators are detected.
What to look for
- HTTP requests with authenticationToken=j:%7B%7D or authenticationToken=j:{}
- Running virtual machine named pivot2
- VMs configured with hvm_serial: file parameter
- Suspicious files /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, /.ustar6
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.