Xen Orchestra auth bypass is being exploited: a crafted cookie gives admin and can lead to root on XCP-ng hosts; patch to 6.9.2 or 6.10.1
- Who is at risk: Vates says most deployments are not internet-facing; any Xen Orchestra reachable from the internet should be treated as urgent.
- Do now: update (XOA: XOA > Updates; from source: latest
masterwith PR #10748), put the console behind a VPN or management network, and block the attacker infrastructure Vates lists. - If you were exposed: Vates says there is no log entry for the unauthenticated access, so revoke all sessions and API tokens and rotate host root passwords, pool secret, proxy, backup-remote (NFS, S3, Azure, SMB), user, OTP and mail credentials. On confirmed compromise Vates recommends a full reinstall.
- Same day: Vates also published VSA-2026-057 (critical, pool-secret comparison, CVE-2026-102705) and VSA-2026-060 (critical, xen-netback use-after-free) for XCP-ng 8.3, plus VSA-2026-063 for Xen Orchestra vm.import.
- See the hunting item for Vates' indicators.
- Credit: Filip Magic and Christoffer Olsen (TDC NET Security).
Sources: Vates: VSA-2026-062, Empty-object login token (Xen Orchestra, Nov 10, 2026) · XCP-ng forum: VSA-2026-062 critical Xen Orchestra vulnerability fixed, please update (Vates) · Vates security advisories index (VSA-2026-057 to 063 published Nov 10, 2026)