France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited [1]. Vates rates it Critical, saying an attacker can bypass authentication and act with Admin privilege, leading to arbitrary code execution on managed pools and full root takeover of XCP-ng nodes; no CVE ID or CVSS score has been assigned yet [1][2]. Administrators should upgrade Xen Orchestra to 6.9.1 (stable) or 6.10.0 (latest) right away, and if they cannot yet, keep Xen Orchestra off the internet and block 91.211.251.112 and Tor traffic, rotating all passwords and secrets if compromised [1][2].
CriticalActiveOfficially confirmed
Attackers exploit Xen Orchestra empty-object login token flaw VSA-2026-062 to gain admin rights without credentials and take over XCP-ng hosts as root
1 min read
- Disclosed
- Nov 10, 2026
- Occurred
- Nov 10, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Exploitation and patch status
- ExploitedPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Vates Xen Orchestra / Xen Orchestra Appliance
What to do nowOur advice
- Upgrade Xen Orchestra to 6.9.1 (stable, xo-server 5.211.2) or 6.10.0 (latest, xo-server 5.213.1) immediately .
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Vates Xen Orchestra / Xen Orchestra Appliance | < 6.9.1 (stable), < 6.10.0 (latest)[1] | 6.9.1 / 6.10.0 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
- 1Upgrade Xen Orchestra patch[1]
Upgrade to 6.9.1 (stable, xo-server 5.211.2) or 6.10.0 (latest, xo-server 5.213.1).
- 2Restrict the interface and block attacker infrastructure mitigate[1]
Keep Xen Orchestra off the internet on a dedicated management network, block 91.211.251.112 and Tor traffic, and block the empty-token cookie in a WAF or reverse proxy.
- 3Check indicators of compromise detect[1]
Monitor HTTP requests for authenticationToken=j:{} and check XCP-ng hosts for hvm_serial: file settings, a pivot2 VM and files such as /etc/cron.d/zz-ustar.
- 4Rotate secrets if compromised
References
Official / primary1
- [1]
“An adversary can bypass authentication and perform actions with 'Admin' privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root .”
Media1
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.