Vates confirms Xen Orchestra login bypass chained with VM import abuse
Vates confirmed an attacker bypassed Xen Orchestra login and abused VM import. Upgrade to 6.9.2 stable or 6.10.1 latest for the login fix. Keep VM import restricted to Admin while a separate fix is pending.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Reachable Xen Orchestra and XOA management consoles, and users with delegated VM-import or network-management rights.
- Xen Orchestra · XCP-ng · authentication · virtualization
- In the wild
- Yes
- Vates observed a threat actor abuse both paths.
What happened
VSA-2026-062 affects the REST authentication path. A reachable vulnerable console can interpret a malformed cookie as an unfiltered lookup. If the returned token is still valid, the requester can act as its owner. Administrator access can lead to code execution on managed pools and root access on XCP-ng nodes.
VSA-2026-063 affects 6.10.1 and earlier and XOA. Xen Orchestra submits VM imports to XAPI with pool administrator rights. A user holding any of the four privileges listed above can send a crafted XVA that compromises a host. Vates saw an attacker use the import path with Admin privileges obtained through the login bypass. The two advisories list no CVSS score or CVE. Vates has not published a victim count.
Hunting. Network indicators include 91.211.251[.]112:8001 · 193.148.56[.]72 · 37.221.208[.]216 · 45.66.35[.]11 · 64.65.0[.]120 · 64.65.62[.]160 · 89.47.51[.]90 · 92.60.37[.]247 · ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333. Review HTTP logs or captures at the point where TLS terminates for an empty-object authenticationToken cookie such as authenticationToken=j:{} or authenticationToken=j:%7B%7D. Search running VMs and host logs for these artifacts: pivot2 · hvm_serial: file · /var/log/xensource.log* (search for -serial file:) · /etc/cron.d/zz-ustar2 · /etc/cron.d/zz-ustar · /.ustar5 · /.ustar6 · /etc/ld.so.preload. Check the full Detection and Mitigations sections in VSA-2026-062. A match alone does not establish compromise.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Xen Orchestra stable channel | 6.9.2 | |
| Xen Orchestra latest channel | 6.10.1 | |
| VM import | No fix | Restrict to Admin |
Crime-scene timeline
Nov 10, 2026
Vates discloses two exploited Xen Orchestra paths
The login bypass is fixed in both channels. The VM-import issue remains under remediation.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Vates VSA-2026-062PrimaryConfirms exploitation, login-bypass fixes, detection indicators and recovery guidance.
- Vates VSA-2026-063PrimaryDocuments the VM-import prerequisites, observed chaining and interim permissions mitigation.