{
  "id": "xen-orchestra-exploited-chain",
  "url": "https://ohshit.app/incidents/xen-orchestra-exploited-chain/",
  "title": "Vates confirms Xen Orchestra login bypass chained with VM import abuse",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-10",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Xen Orchestra",
    "XCP-ng",
    "authentication",
    "virtualization"
  ],
  "ecosystems": [],
  "summary": "Vates confirmed an attacker bypassed Xen Orchestra login and abused VM import. Upgrade to 6.9.2 stable or 6.10.1 latest for the login fix. Keep VM import restricted to Admin while a separate fix is pending.",
  "splash": "Reachable Xen Orchestra and XOA management consoles, and users with delegated VM-import or network-management rights.",
  "wipe": "Isolate management access, patch the login bypass, restrict VM import and investigate managed hosts.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [
    {
      "product": "Xen Orchestra stable channel",
      "version": "6.9.2"
    },
    {
      "product": "Xen Orchestra latest channel",
      "version": "6.10.1"
    },
    {
      "product": "VM import",
      "version": "none",
      "status": "Restrict to Admin"
    }
  ],
  "checklist": [
    {
      "title": "Restrict the console and apply the login fix",
      "hint": "Put Xen Orchestra on a dedicated management network without public access. Verify the installed xo-server package is at least 5.211.2 on stable or 5.213.1 on latest. For source builds, update to current master as Vates directs. Block ingress and egress to the published infrastructure below, including Tor traffic where applicable. Filter known empty-object cookie forms at the reverse proxy or WAF while patching. Alternate encodings can evade the filter."
    },
    {
      "title": "Restrict VM import while its fix is pending",
      "hint": "Allow VM import only for Admin users. Disable accounts assigned vm.import, sr/import:vm, network/action:create or network/action:update under Vates guidance. Review delegated roles and check VSA-2026-063 for the eventual fix."
    },
    {
      "title": "Hunt on both the console and managed hosts",
      "hint": "Check the network and host indicators in the article body and the vendor advisory. Xen Orchestra does not record the bypass as an unauthenticated access event, so check available HTTP traffic and XCP-ng host artifacts as well. Corroborate hits and investigate suspicious access even if none match."
    },
    {
      "title": "Recover compromised environments",
      "hint": "Isolate affected hosts, preserve traffic, configuration and logs, and follow Vates guidance to fully reinstall systems with confirmed compromise from trusted media. Rotate VMS secrets from a clean system, including pool and root credentials, accounts, OTP secrets, proxy and backup storage credentials and SMTP passwords. Verify access and backups before restoring connectivity."
    }
  ],
  "sources": [
    {
      "name": "Vates VSA-2026-062",
      "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
      "says": "Confirms exploitation, login-bypass fixes, detection indicators and recovery guidance.",
      "primary": true
    },
    {
      "name": "Vates VSA-2026-063",
      "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-063/",
      "says": "Documents the VM-import prerequisites, observed chaining and interim permissions mitigation.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Vates observed a threat actor abuse both paths.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 10, 2026",
      "title": "Vates discloses two exploited Xen Orchestra paths",
      "body": "The login bypass is fixed in both channels. The VM-import issue remains under remediation."
    }
  ],
  "body_markdown": "VSA-2026-062 affects the REST authentication path. A reachable vulnerable console can interpret a malformed cookie as an unfiltered lookup. If the returned token is still valid, the requester can act as its owner. Administrator access can lead to code execution on managed pools and root access on XCP-ng nodes.\n\nVSA-2026-063 affects 6.10.1 and earlier and XOA. Xen Orchestra submits VM imports to XAPI with pool administrator rights. A user holding any of the four privileges listed above can send a crafted XVA that compromises a host. Vates saw an attacker use the import path with Admin privileges obtained through the login bypass. The two advisories list no CVSS score or CVE. Vates has not published a victim count.\n\n**Hunting.** Network indicators include 91.211.251[.]112:8001 · 193.148.56[.]72 · 37.221.208[.]216 · 45.66.35[.]11 · 64.65.0[.]120 · 64.65.62[.]160 · 89.47.51[.]90 · 92.60.37[.]247 · ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333. Review HTTP logs or captures at the point where TLS terminates for an empty-object authenticationToken cookie such as `authenticationToken=j:{}` or `authenticationToken=j:%7B%7D`. Search running VMs and host logs for these artifacts: pivot2 · hvm_serial: file · /var/log/xensource.log* (search for -serial file:) · /etc/cron.d/zz-ustar2 · /etc/cron.d/zz-ustar · /.ustar5 · /.ustar6 · /etc/ld.so.preload. Check the full Detection and Mitigations sections in VSA-2026-062. A match alone does not establish compromise."
}