Vates warns that attackers are actively exploiting a critical authentication bypass in Xen Orchestra.
Its November 10 advisory says an empty-object login token can be treated as an unrestricted token lookup. Successful exploitation can grant administrator access, enabling arbitrary code execution on managed pools and potentially full root control of XCP-ng nodes.
The affected versions are Xen Orchestra releases before 6.9.2 on the stable channel and 6.10.1 on the latest channel. The advisory also lists Xen Orchestra Appliance as affected.
Vates identifies 6.9.2 and 6.10.1 as fixed releases. Their corresponding xo-server packages are 5.211.2 and 5.213.1. Source installations should update to the latest master branch.
Administrators should update promptly and restrict Xen Orchestra to a dedicated management network. If compromise occurred, Vates advises rotating all relevant passwords and secrets; confirmed compromise warrants full reinstallation. Its published indicators cover the observed campaign, so their absence does not establish that a system is clean.
