Editorial Team
5 min read
Xen Orchestra patches exploited login bypass as VM import flaw remains open
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
- Vates has fixed an actively exploited login bypass that can expose virtualization hosts to takeover.
- Vates’s November 10 advisory lists a separate VM import flaw as unfixed; users with certain delegated permissions can also abuse it.
- Missing attack indicators do not prove a system escaped compromise; Vates recommends reinstalling confirmed compromised systems.
Vates, the French software company behind Xen Orchestra, has patched a login bypass being exploited against its web-based virtualization management platform. A separate VM import path used by the attacker remained unfixed in the company’s November 10 advisory, leaving administrators with a permissions review as well as an urgent update.
Xen Orchestra manages virtual machines, hosts, storage and pools, and provides backup and disaster recovery for XCP-ng and XenServer virtualization environments. The Xen Orchestra Appliance packages the platform. Vates warns that compromise can lead to arbitrary code execution on managed pools and takeover of an XCP-ng host as root, its most privileged account, as relayed in the report on the attacks.
Xen Orchestra’s dashboard in Vates’s documentation. This product example does not depict an affected deployment. Source: Vates VMS Documentation.
A login check becomes a token lookup
The authentication bypass, tracked as VSA-2026-062, turns a malformed login token into access through a failure to enforce the expected data type. According to Vates’s advisory, REST cookie parsing can produce an empty object instead of a string. The token collection then treats that object as an unrestricted lookup and returns its first token.
There is a consequential condition: the returned token must be unexpired for the provider to authenticate the requester as its owner. Once authenticated, the requester can reach an endpoint that returns reusable login token IDs. The flaw therefore concerns both entry and the ability to obtain credentials for further access.
An attacker needs network access to the management interface, as the initial report explains. Vates’s instruction to keep Xen Orchestra off the public internet and on a dedicated management network addresses that exposure directly.
