A significant security vulnerability in Xen Orchestra has been identified by French software company Vates VMS, raising concerns about potential security breaches. The flaw, which is currently being actively exploited, has not yet been assigned a CVE identifier but is referred to as VSA-2026-062. This critical issue allows attackers to bypass authentication mechanisms and gain administrative access.
Technical Details of the Vulnerability
The vulnerability arises from how REST cookies are parsed in Xen Orchestra. According to Vates VMS, an authentication bypass can occur when a specially crafted cookie is sent. The REST authentication process incorrectly processes this cookie format, enabling attackers to gain unauthorized access. This can lead to arbitrary code execution on managed pools and even a complete takeover of the XCP-ng node as root.
Attackers exploiting this flaw can send a cookie formatted as “authenticationToken=j:%7B%7D,” which the system interprets as an unfiltered lookup. The provider may then authenticate using the first token it encounters, potentially giving the attacker administrative privileges.
Active Exploitation and Indicators
Vates VMS has detected active exploitation of this vulnerability by a threat actor linked to the IP address 91.211.251[.]112:8001. This IP has been identified as a command-and-control server for RedLine Stealer on VirusTotal. Additionally, the threat actor operates from a TOR domain, ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333.
It remains unclear when the exploitation began and whether it was initially a zero-day vulnerability. Key indicators of compromise include HTTP requests with specific token formats, the presence of a virtual machine named pivot2, and certain suspicious files on the system.
Mitigation and Security Recommendations
To mitigate this issue, Vates VMS has released updates for Xen Orchestra versions 6.9.1 and 6.10.0, along with xo-server versions 5.211.2 and 5.213.1. Organizations unable to apply these updates immediately should consider several precautionary measures. These include avoiding exposing Xen Orchestra instances to the internet, blocking the identified malicious IP and domain, and implementing security controls such as web application firewalls to block empty tokens.
Additionally, rotating all passwords and secrets within Vates VMS is advised if any indicators of compromise are detected. The discovery and reporting of the flaw have been credited to cybersecurity experts Filip Magic and Christoffer Olsen from TDC NET Security.
Addressing this vulnerability is crucial to maintain the integrity and security of systems using Xen Orchestra, and timely action is essential to prevent unauthorized access and potential data breaches.
