Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

Vates VMS, a French software company, has issued a warning about a critical security vulnerability in Xen Orchestra that is currently being exploited by hackers. This authentication bypass flaw, identified as VSA-2026-062, allows attackers to gain administrative access without proper authentication. The flaw is reportedly being used in the wild, posing a significant risk to systems running affected versions of Xen Orchestra.

The vulnerability arises from a flaw in the token collection process, where an unfiltered lookup returns the first token, allowing the attacker to authenticate as the token's owner if it is still valid. This effectively enables unauthorized access to the system's administrative functions. Vates VMS has released updates to address this issue in Xen Orchestra versions 6.9.1 and 6.10.0, as well as xo-server versions 5.211.2 and 5.213.1. Security researchers Filip Magic and Christoffer Olsen from TDC NET Security have been credited with discovering the flaw.

In addition to the authentication bypass, Vates VMS has revealed that the vulnerability is being exploited alongside another flaw, VSA-2026-063. This second flaw allows an unprivileged user to import a malicious virtual machine (VM) using a specially crafted keys parameter, potentially compromising an XCP-ng host. The company has advised that until a fix is available, authorized VM imports should be restricted to admin users only, and users with certain privileges should be disabled.

The exploitation of these vulnerabilities is reportedly linked to a threat actor using specific IP addresses and TOR domains to execute their attacks.