www.it-connect.fr
Critical Xen Orchestra Flaw Already Exploited Can Take Over XCP-ng Hosts
A critical security flaw, already exploited in the wild, can lead to the full compromise of XCP-ng hosts. Here is what we know about this vulnerability threatening virtualization infrastructures.
As a reminder, Xen Orchestra is the web interface developed by French vendor Vates to manage XCP-ng environments: hosts, pools, virtual machines, backups... In other words, it is the console that has control over the entire virtualization infrastructure. The XCP-ng and Xen Orchestra duo is one of the solutions I mentioned some time ago in my article on alternatives to the VMware ESXi hypervisor.
On November 10, 2026, Vates published a security advisory to report a critical security flaw discovered in Xen Orchestra and the official XOA (Xen Orchestra Appliance). For now, this vulnerability has neither a CVE identifier nor a CVSS score. Even so, it deserves our attention.
An empty token that grants administrative rights
The issue lies in the Xen Orchestra REST API, specifically in how it processes the authenticationToken cookie. If an attacker sends the value j:{} (or its encoded form j:%7B%7D), the server sees JSON because of the j: prefix and converts it into an empty object instead of treating it as a string. That object is then passed as-is to the component responsible for looking up the token.
With no search criteria, the first token in the database is returned. If it has not expired, the request is authenticated as its owner, with that user's privileges (potentially an admin). The attacker can then query the /rest/v0/users/me/authentication_tokens route to recover reusable token identifiers, and therefore keep access.
Vates mentions actions performed with Admin privileges, arbitrary code execution on managed pools, and "a full takeover of an XCP-ng node as root".
Most importantly, the concerning part is that this flaw is actively being exploited by a cybercriminal (notably associated with IP address 91.211.251.112). But when looking at Vates' security advisory, you do not just find one IP address, but 8 at the time of writing, along with a .onion service (Tor network). In other words, the list appears to be expanding over time.
Xen Orchestra: how can you protect yourself?
Vates recommends installing the patch as soon as possible and lists several additional measures:
- Update Xen Orchestra: upgrade to XOA 6.10.1 (latest channel) or 6.9.2 (stable channel). The fix corresponds to xo-server, the Xen Orchestra server component, in versions 5.213.1 and 5.211.2.
- Do not expose Xen Orchestra to the Internet: the instance should be placed on a dedicated administration network. This may seem obvious, but it is always worth repeating.
- Block the attacker's infrastructure: filter traffic coming from and going to the eight IP addresses listed in the advisory, and block Tor traffic to the indicated .onion address
- Filter the empty token: if you cannot update immediately, add a rule on the WAF or reverse proxy to block both forms of the malicious cookie.
How do you know whether your server has been compromised? Vates warns that no log file allows detection of the unauthenticated access. You therefore need to look for the traces left behind afterward. In Xen Orchestra, a virtual machine named pivot2. On XCP-ng hosts, the files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6, as well as a /etc/ld.so.preload file, are signs of compromise. There are also cases where a VM has its serial port redirected to a file (parameter hvm_serial: file, also visible in xensource.log). I will not go into too much detail here, because the advisory published by Vates provides the commands to help you.
A second flaw, with no fix available yet
On the same day, Vates published a second advisory, this time considered important. It concerns virtual machine import: Xen Orchestra passes the file to the host without checking its contents, which makes it possible to slip in malicious parameters, including hvm_serial. Vates says the attacker used this mechanism with Admin privileges, pointing back to the first flaw. In other words, some cyberattacks exploit these two vulnerabilities together.
Xen Orchestra 6.10.1 and earlier versions are affected, and no fix was available at the time of the advisory. In the meantime, Vates recommends restricting VM import to administrators. This is definitely something to monitor closely if you use this solution, and to patch as soon as possible.
