XEN ORCHESTRA · CMP-202611-csqe25 · Infrastructure
FIX → 6.10.0 +1
Vates published advisory VSA-2026-062 on 10 Nov 2026: a critical flaw in Xen Orchestra and the Xen Orchestra Appliance lets anyone bypass login with an empty-object token cookie (authenticationToken=j:{}), act as Admin, and from there run code on managed pools and take over XCP-ng hosts as root. Vates says it is being actively exploited by a threat actor working from 91.211.251.112:8001 and a Tor .onion address, who leaves a VM named pivot2 and cron/preload persistence on hosts. Fixed in Xen Orchestra 6.10.0 (latest channel, xo-server 5.213.1) and 6.9.1 (stable channel, xo-server 5.211.2). CVE: unknown. Number of victims and when exploitation began: unknown.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
6.10.0 (latest) / 6.9.1 (stable), i.e. xo-server older than 5.213.1 / 5.211.291.211.251.112 (port 8001) or Tor traffic to ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333hvm_serial: file; zgrep -- -serial file: /var/log/xensource.log*; ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar* (files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6)Upgrade to 6.10.0 +1
6.10.0 (latest) or 6.9.1 (stable)91.211.251.112 and Tor traffic, and add a WAF/reverse-proxy rule for authenticationToken=j:{} and j:%7B%7D (Vates warns other encodings can bypass a regex)Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.