--- title: Critical Xen Orchestra auth bypass flaw exploited to... description: A critical authentication bypass flaw in Xen Orchestra is being actively exploited in attacks that could take over XCP-ng virtualization hosts. Tracked as... canonical: https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers | daily.dev og:description: A critical authentication bypass flaw in Xen Orchestra is being actively exploited in attacks that could take over XCP-ng virtualization hosts. Tracked as... og:url: https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x og:image: https://api.daily.dev/og/posts/Sn1TDpS4X.png og:image:alt: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A critical authentication bypass flaw in Xen Orchestra is being actively exploited in attacks that could take over XCP-ng virtualization hosts. Tracked as VSA-2026-062, it lets remote attackers send a crafted cookie, 'authenticationToken=j:%7B%7D', to log in as the owner of an existing authentication token without credentials. Attackers could then gain admin privileges, possibly execute arbitrary code on managed pools, and take over nodes as root. Vates released Xen Orchestra 6.9.1 and 6.10.0, including patched xo-server packages 5.211.2 and 5.213.1. Indicators of compromise include a VM named 'pivot2' and files like '/etc/cron.d/zz-ustar'. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Xen Orchestra authentication bypass vulnerability VSA-2026-062 work? Attackers send a specially crafted cookie, 'authenticationToken=j:%7B%7D', containing an empty JSON object, which tricks Xen Orchestra into retrieving an existing authentication token and logging them in as its owner without real credentials. Once authenticated, they can pull reusable login token IDs via the '/rest/v0/users/me/authentication_tokens' REST API endpoint and gain admin privileges, leading to arbitrary code execution and full XCP-ng node takeover as root. _Teams running XCP-ng can track emerging virtualization CVEs and patch guidance on daily.dev._ ### Which Xen Orchestra versions fix the VSA-2026-062 authentication bypass vulnerability? Vates patched the flaw in Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), including updated xo-server packages 5.211.2 and 5.213.1. Administrators who cannot update immediately should restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses while they plan the upgrade. _Developers tracking patch releases for virtualization platforms can follow advisories like this on daily.dev._ ### What indicators of compromise should I check for after the Xen Orchestra authentication bypass attacks? Look for connections to 91.211.251.112:8001 or the listed onion address, HTTP requests with the cookie 'authenticationToken=j:%7B%7D', a VM named 'pivot2', VMs configured with 'hvm_serial: file', and unusual files such as '/etc/cron.d/zz-ustar' or '/.ustar5'. Vates notes the exploit itself leaves no log trace, so HTTP monitoring is needed to catch the crafted cookie. _Security teams hunting for breach indicators can keep up with fresh IOC reports like this on daily.dev._ ## Similar posts on daily.dev - [VMware fixes command injection flaw in Aria Operations](https://daily.dev/posts/vmware-fixes-command-injection-flaw-in-aria-operations-ue2mrjloo) · CSO Online · 0 upvotes · 0 comments - [VMware Aria Operations Bug Exploited, Cloud Resources at Risk](https://daily.dev/posts/vmware-aria-operations-bug-exploited-cloud-resources-at-risk-6wzhmakwc) · Dark Reading · 0 upvotes · 0 comments - [Pentest-Tools.com Releases Free Scanner for CVE-2026-41940 as cPanel Authentication Bypass Enters Its Third Week of Active Exploitation](https://daily.dev/posts/pentest-tools-com-releases-free-scanner-for-cve-2026-41940-as-cpanel-authentication-bypass-enters-it-s5ky32w4r) · IT Security Guru · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#infrastructure](https://daily.dev/tags/infrastructure) [View this post on daily.dev](https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers","url":"https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x"},"datePublished":"2026-11-10T16:21:40.843Z","dateModified":"2026-11-10T16:23:27.212Z","description":"A critical authentication bypass flaw in Xen Orchestra is being actively exploited in attacks that could take over XCP-ng virtualization hosts. Tracked as...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/70ae00ad1c2800e46119d3ec3a50150e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/70ae00ad1c2800e46119d3ec3a50150e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,infrastructure","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-sn1tdps4x#faq","mainEntity":[{"@type":"Question","name":"How does the Xen Orchestra authentication bypass vulnerability VSA-2026-062 work?","acceptedAnswer":{"@type":"Answer","text":"Attackers send a specially crafted cookie, 'authenticationToken=j:%7B%7D', containing an empty JSON object, which tricks Xen Orchestra into retrieving an existing authentication token and logging them in as its owner without real credentials. Once authenticated, they can pull reusable login token IDs via the '/rest/v0/users/me/authentication_tokens' REST API endpoint and gain admin privileges, leading to arbitrary code execution and full XCP-ng node takeover as root. Teams running XCP-ng can track emerging virtualization CVEs and patch guidance on daily.dev."}},{"@type":"Question","name":"Which Xen Orchestra versions fix the VSA-2026-062 authentication bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Vates patched the flaw in Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), including updated xo-server packages 5.211.2 and 5.213.1. Administrators who cannot update immediately should restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses while they plan the upgrade. Developers tracking patch releases for virtualization platforms can follow advisories like this on daily.dev."}},{"@type":"Question","name":"What indicators of compromise should I check for after the Xen Orchestra authentication bypass attacks?","acceptedAnswer":{"@type":"Answer","text":"Look for connections to 91.211.251.112:8001 or the listed onion address, HTTP requests with the cookie 'authenticationToken=j:%7B%7D', a VM named 'pivot2', VMs configured with 'hvm_serial: file', and unusual files such as '/etc/cron.d/zz-ustar' or '/.ustar5'. Vates notes the exploit itself leaves no log trace, so HTTP monitoring is needed to catch the crafted cookie. Security teams hunting for breach indicators can keep up with fresh IOC reports like this on daily.dev."}}]} ```