---
title: Xen Orchestra auth bypass is being exploited: a crafted cookie gives admin and can lead to root on XCP-ng hosts; patch to 6.9.2 or 6.10.1 | ctxsec
url: https://ctxsec.com/items/xen-orchestra-vsa-2026-062-empty-object-cookie-auth-bypass-actively-exploited-xcp-ng-root
description: "Vates says a critical authentication bypass in Xen Orchestra, the web console for XCP-ng virtualization, is being actively exploited. Sending the cookie authenticationToken=j:{} makes the REST API treat an empty object as a token lookup with no filter, so it logs the attacker in as the owner of the first unexpired token; the attacker can then list reusable login tokens. Vates says that admin access can lead to code execution on managed pools and full takeover of XCP-ng hosts as root. Fixed in Xen Orchestra 6.9.2 (stable) and 6.10.1 (latest), xo-server 5.211.2 and 5.213.1; the Xen Orchestra Appliance is also affected."
status: "official (Vates advisory VSA-2026-062, Nov 10, 2026); Vates says it is actively exploited; no CVE or CVSS assigned yet"
published: 2026-11-11
---

> Vates says a critical authentication bypass in Xen Orchestra, the web console for XCP-ng virtualization, is being actively exploited. Sending the cookie authenticationToken=j:{} makes the REST API treat an empty object as a token lookup with no filter, so it logs the attacker in as the owner of the first unexpired token; the attacker can then list reusable login tokens. Vates says that admin access can lead to code execution on managed pools and full takeover of XCP-ng hosts as root. Fixed in Xen Orchestra 6.9.2 (stable) and 6.10.1 (latest), xo-server 5.211.2 and 5.213.1; the Xen Orchestra Appliance is also affected.

[← Cybersecurity News](/news) · [markdown](/items/xen-orchestra-vsa-2026-062-empty-object-cookie-auth-bypass-actively-exploited-xcp-ng-root.md)

official (Vates advisory VSA-2026-062, Nov 10, 2026); Vates says it is actively exploited; no CVE or CVSS assigned yet

2026-11-11 7:44 AM ET

### Xen Orchestra auth bypass is being exploited: a crafted cookie gives admin and can lead to root on XCP-ng hosts; patch to 6.9.2 or 6.10.1

- **Who is at risk:** Vates says most deployments are not internet-facing; any Xen Orchestra reachable from the internet should be treated as urgent.
- **Do now:** update (XOA: XOA > Updates; from source: latest `master` with PR #10748), put the console behind a VPN or management network, and block the attacker infrastructure Vates lists.
- **If you were exposed:** Vates says there is no log entry for the unauthenticated access, so revoke all sessions and API tokens and rotate host root passwords, pool secret, proxy, backup-remote (NFS, S3, Azure, SMB), user, OTP and mail credentials. On confirmed compromise Vates recommends a full reinstall.
- **Same day:** Vates also published VSA-2026-057 (critical, pool-secret comparison, CVE-2026-102705) and VSA-2026-060 (critical, xen-netback use-after-free) for XCP-ng 8.3, plus VSA-2026-063 for Xen Orchestra vm.import.
- See the hunting item for Vates' indicators.
- Credit: Filip Magic and Christoffer Olsen (TDC NET Security).

Sources: [Vates: VSA-2026-062, Empty-object login token (Xen Orchestra, Nov 10, 2026)](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/) · [XCP-ng forum: VSA-2026-062 critical Xen Orchestra vulnerability fixed, please update (Vates)](https://xcp-ng.org/forum/topic/12571/security-vsa-2026-062-critical-xen-orchestra-vulnerability-fixed-please-update) · [Vates security advisories index (VSA-2026-057 to 063 published Nov 10, 2026)](https://docs.vates.tech/security-advisories/advisories/)