Xen Orchestra Authentication Bypass (VSA-2026-062) Actively Exploited to Hijack VM Servers

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5663 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Xen Orchestra Empty-Object authenticationToken Auth Bypass (VSA-2026-062) — Exploitation

Behaviour-first Splunk detection for the Xen Orchestra REST authentication bypass: flags HTTP requests whose authenticationToken cookie is the empty-object payload j:{} (or URL-encoded j:%7B%7D) and highlights sources that then call /rest/v0/users/me/authentication_tokens to harvest reusable login tokens. Exploited in the wild by infrastructure including 91.211.251.112.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078, T1528, T1550.001
• Data sources: splunk_stream_http, reverse_proxy_access_logs, waf_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="stream:http" http_method IN ("GET","POST","PUT","PATCH","DELETE") cookie=*
| regex cookie="(?i)authenticationToken=j(:|%3A)(\{\s*\}|%7B(\s|%20|\+)*%7D)"
| eval token_endpoint=if(like(lower(uri_path),"%/rest/v0/users/me/authentication_tokens%"),1,0)
| stats count AS requests sum(token_endpoint) AS token_listing_requests min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS uri_paths values(dest_ip) AS xo_servers values(status) AS http_status BY src_ip
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| eval stage=if(token_listing_requests>0,"auth_bypass_plus_token_harvest","auth_bypass_attempt")
| table src_ip xo_servers requests token_listing_requests stage uri_paths http_status first_seen last_seen

Microsoft KQL

let lookback = 24h;
let bypassCookie = @'(?i)authenticationToken=j(:|%3A)(\{\s*\}|%7B(\s|%20|\+)*%7D)';
let tokenEndpoint = '/rest/v0/users/me/authentication_tokens';
union isfuzzy=true
  ( CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | extend Raw = strcat(tostring(column_ifexists("RequestCookies", "")), " ", RequestContext, " ", AdditionalExtensions, " ", Message)
    | project TimeGenerated, Computer, SrcIp = SourceIP, Url = RequestURL, Raw ),
  ( Syslog
    | where TimeGenerated > ago(lookback)
    | where ProcessName in~ ("nginx", "haproxy", "httpd", "apache2", "traefik", "caddy")
    | project TimeGenerated, Computer, SrcIp = extract(@'(\d{1,3}(?:\.\d{1,3}){3})', 1, SyslogMessage), Url = extract(@'"(?:GET|POST|PUT|PATCH|DELETE) (\S+)', 1, SyslogMessage), Raw = SyslogMessage )
| extend CookieHit = Raw matches regex bypassCookie, TokenListing = (Url contains tokenEndpoint or Raw contains tokenEndpoint)
| summarize CookieRequests = countif(CookieHit), TokenListingRequests = countif(TokenListing), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Targets = make_set(Computer, 10), SampleUrls = make_set(Url, 10) by SrcIp
| where CookieRequests > 0
| extend Stage = iff(TokenListingRequests > 0, "auth_bypass_plus_token_harvest", "auth_bypass_attempt")
| project SrcIp, Stage, CookieRequests, TokenListingRequests, Targets, SampleUrls, FirstSeen, LastSeen

Sigma

title: Xen Orchestra Empty-Object authenticationToken Cookie Authentication Bypass (VSA-2026-062)
id: 3f6b1a52-7c1e-4d0a-9b8e-5a2c4e7d1f01
status: experimental
description: Detects HTTP requests to Xen Orchestra or XOA carrying the crafted authenticationToken cookie (empty object, plain or URL-encoded) that bypasses REST authentication. XO does not log this, so telemetry must come from a reverse proxy, WAF or web server in front of XO.
references:
    - https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/
    - https://github.com/vatesfr/xen-orchestra/pull/10748
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1078
    - attack.defense-evasion
    - attack.t1550.001
    - attack.credential-access
    - attack.t1528
logsource:
    category: webserver
detection:
    selection_cookie:
        cs-cookie|contains:
            - 'authenticationToken=j:{}'
            - 'authenticationToken=j:%7B%7D'
            - 'authenticationToken=j%3A%7B%7D'
            - 'authenticationToken=j%3A{}'
    condition: selection_cookie
fields:
    - c-ip
    - cs-uri-stem
    - cs-cookie
    - cs-host
    - sc-status
falsepositives:
    - Authorised vulnerability scanners validating VSA-2026-062 exposure
    - Internal red-team or patch-validation testing against Xen Orchestra
level: critical

Known false positives:

• Authorised vulnerability scanners or red-team tooling replaying the VSA-2026-062 empty-object cookie against Xen Orchestra
• Patch-validation testing in a lab where the cookie is deliberately sent to confirm the fix

Tuning notes: Requires HTTP-layer telemetry in front of Xen Orchestra (Splunk Stream, reverse-proxy or WAF logs that record the Cookie header) because XO itself does not log the bypass. Adjust index/sourcetype to your proxy; allowlist known scanner source IPs; treat any hit from an untrusted source as critical and revoke XO authentication tokens. The regex covers URL-encoded variants, but the vendor notes other encodings may evade simple rules, so pair with patching to xo-server 5.211.2/5.213.1.

• 🔒 Xen Orchestra Empty-Object Cookie Bypass and Token Harvest (Sentinel) — Exploitation · unlock with TL Creds
• 🔒 XCP-ng Persistence and Rogue VM Artifacts (Sentinel) — Post-Exploitation · unlock with TL Creds
• 🔒 Xen Orchestra Campaign C2: Actor IP and Onion Service Contact (Sentinel) · unlock with TL Creds
• 🔒 Xen Orchestra Empty-Object authenticationToken Cookie (Sigma) — Exploitation · unlock with TL Creds
• 🔒 XCP-ng Campaign Persistence Files (Sigma) — Post-Exploitation · unlock with TL Creds
• 🔒 Xen Orchestra Campaign C2 Connections (Sigma) — C2 / Multi-hop Proxy · unlock with TL Creds
• 🔒 XCP-ng Post-Exploitation Artifacts: zz-ustar Cron, .ustar Files, ld.so.preload, [indicator] / hvm_serial VM · unlock with TL Creds
• 🔒 Connections To Xen Orchestra Campaign C2 Infrastructure ([indicator]) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5663.

Sample indicators (3 of 25)

• IP address: 91.211.251[.]112
• Domain: ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion
• IP address: 193.148.56[.]72

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

Technical analysis

VSA-2026-062 ("Empty-object login token") is an authentication bypass in the REST API of Xen Orchestra (XO), the management plane for XCP-ng/XenServer pools, and in the Xen Orchestra Appliance (XOA). REST cookie parsing converts a crafted authenticationToken cookie (authenticationToken=j:{} or URL-encoded authenticationToken=j:%7B%7D) into an empty JavaScript object. The REST authentication path passes that object to the token provider without verifying that it is a string. The token collection lookup treats the empty object as an unfiltered query and returns the first stored token; if that token is unexpired, the requester is authenticated as the token's owner without any credentials.

After bypassing authentication, the attacker calls the authenticated endpoint /rest/v0/users/me/authentication_tokens to retrieve reusable login token IDs, giving durable access that survives patching unless tokens are revoked. Vates states the attacker can perform actions with Admin privilege, which can lead to arbitrary code execution on managed pools and full root takeover of XCP-ng nodes.

Vates attributes exploitation observed in the wild to a threat actor using IP address 91.211.251.112 (port 8001 listed) and the Tor onion service ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion (port 3333 listed). Reported host-side artifacts of this campaign include a VM named 'pivot2', VMs configured with the hvm_serial: file platform parameter (visible as '-serial file:' in /var/log/xensource.log*), cron files /etc/cron.d/zz-ustar and /etc/cron.d/zz-ustar2, files /.ustar5 and /.ustar6, and Vates also directs responders to inspect /etc/ld.so.preload. Vates stresses these indicators cover only this campaign and their absence does not prove no compromise.

The flaw was fixed in upstream PR #10748 ("fix(xo-server): validate authentication token IDs", XO-3331, merge commit 50166fe), which rejects non-string and empty token IDs before collection lookups and builds the query only from validated fields while preserving valid string tokens and compound {id, user_id} lookups; the bug was introduced by commit 115bc8f. The PR author reports validation on an appliance running xo-server 5.213.0 showing non-string and empty token IDs are rejected across the REST API, /signin and JSON-RPC session.signIn; stable-branch backport validation was not run per the PR. Exploitation leaves no identifiers in Xen Orchestra logs, so detection requires HTTP traffic inspection (tcpdump/Wireshark, WAF or reverse-proxy logging) for the empty-object cookie. No CVE or CVSS score had been assigned at the time of publication; Vates rates it Critical (CVSS 4.0 'not available yet'). The advisory page's affected-version text lists xo-server 5.213.2 as affected while naming 5.213.1 as fixed, an inconsistency that should be verified against upstream release notes. Discovered by Filip Magic and Christoffer Olsen of TDC NET Security. No public PoC or named threat actor is reported in the sources.

MITRE ATT&CK techniques by tactic:

Persistence

T1053.003 Cron

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Command and Control

T1090.003 Multi-hop Proxy; T1571 Non-Standard Port

Credential Access

T1528 Steal Application Access Token

lateral-movement

T1550.001 Application Access Token

Defense Evasion

T1564.006 Run Virtual Instance

stealth

T1574.006 Dynamic Linker Hijacking

Remediation

Patches

• xo-server 5.211.2 (stable channel)
• xo-server 5.213.1 (latest channel)
• Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest)

Immediate actions

• Update to Xen Orchestra 6.9.1 (stable) or 6.10.0 (latest), i.e. xo-server 5.211.2 or 5.213.1
• Block ingress and egress traffic to 91.211.251.112 and block Tor traffic to the listed onion address
• Hunt for HTTP requests carrying authenticationToken=j:{} or authenticationToken=j:%7B%7D
• Search running VMs for one named pivot2 and review /rest/v0/users/me/authentication_tokens access
• On XCP-ng hosts run: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file' and ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*

Workarounds

• Restrict XO access to dedicated management networks
• Block authenticationToken=j:{} and authenticationToken=j:%7B%7D in a WAF or reverse proxy (regex rules may be bypassed with other encodings)

Longer-term hardening

• Keep Xen Orchestra off the internet; place it on a dedicated management network
• Capture HTTP traffic or reverse-proxy logs in front of Xen Orchestra since the bypass is not logged by XO
• If compromise is suspected, rotate all passwords and secrets used by the platform including proxy, backup, S3, root and user accounts and revoke authentication tokens

Affected and fixed versions

• Vates — Xen Orchestra (xo-server)
  Vulnerable versions: xo-server before 5.211.2 (stable); xo-server before 5.213.1 (latest); Xen Orchestra before 6.9.1 (stable) and 6.10.0 (latest)
  Fixed in: xo-server 5.211.2; xo-server 5.213.1; Xen Orchestra 6.9.1; Xen Orchestra 6.10.0
• Vates — Xen Orchestra Appliance (XOA)
  Vulnerable versions: Builds with xo-server before 5.211.2 / 5.213.1
  Fixed in: Builds with xo-server 5.211.2 / 5.213.1 or later
• Vates — XCP-ng (hosts managed by vulnerable Xen Orchestra)
  Vulnerable versions: Hosts and pools managed by an unpatched Xen Orchestra (root takeover risk)
  Fixed in: Remediated by patching Xen Orchestra and rotating credentials

Timeline

Last updated 2026-11-11 · 2 updates · revalidated 2× · latest source

• 2026-04-28 Xen publishes XSA-489 (XAPI RBAC issues incl. VBD backend-local and VM.platform hvm_serial abuse), the technique later cited in Vates VSA-2026-063.
• 2026-11-10 Xen publicly releases XSA-530 (updated XAPI RBAC issues), cited by Vates as a demonstration of the VSA-2026-063 approach.
• 2026-11-10 Vates publishes VSA-2026-063 (Important, no CVE, no fix yet): crafted keys in an imported XVA (vm.import / sr/import:vm / network create/update privileges) abused by the same actor after the VSA-2026-062 bypass to take over XCP-ng hosts and run code as root.
• 2026-11-10 Vates does not state when exploitation began or whether it was a zero-day; the introducing commit 115bc8f has no published date. Vates advisory lists eight attacker IPs in total.
• 2026-11-10 At 08:14 PR #10748 was force-pushed to commit 4c76ee2 and marked ready for review, ahead of the 08:29 merge (squash 50166fe).
• 2026-11-10 BleepingComputer reports the exploited authentication bypass and lists campaign IOCs (locked-ioc-7, onion service, pivot2 VM, ustar files)
• 2026-11-10 Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest) released containing the fix
• 2026-11-10 Vates publishes VSA-2026-062 (Critical, no CVE/CVSS) confirming active exploitation; fixes in xo-server 5.211.2 (stable) and 5.213.1 (latest)
• 2026-11-10 PR #10748 approved by KAN-vates and fbeauchamp and merged into xen-orchestra master (commit 50166fe) at about 08:29
• 2026-11-10 Related PR #10749 'fix(xo-server): empty token handling' mentioned by a reviewer on PR #10748 and listed as closed
• 2026-11-10 PR author reports 127 focused auth/REST tests and 614 xo-server tests passing, and appliance testing on xo-server 5.213.0 confirming non-string and empty token IDs are rejected across REST, /signin and JSON-RPC session.signIn; stable backport validation not run
• 2026-11-10 Vates opens PR #10748 'validate authentication token IDs' (XO-3331) to reject non-string and empty token IDs; bug traced to commit 115bc8f
• 2026-11-11 SecurityWeek reports active exploitation of both Xen Orchestra flaws by an unnamed actor operating from locked-ioc-5 and via Tor.

Update history

• 2026-11-11 — Xen Orchestra Critical Auth Bypass (Vates SA-2026-062) and VM Import Host Compromise (SA-2026-063) Exploited in Attacks: What changed No severity/exploitability/status change (already CRITICAL / ACTIVE).
• 2026-11-11 — Xen Orchestra REST Cookie Authentication Bypass (Empty-Object Login Token) Actively Exploited for Admin Access (VSA-2026-062, no CVE assigned): What changed No severity, exploitability or status change; the existing record (CRITICAL / ACTIVE) already reflects the escalated state. Additions are indicators and context only.

Sources cited

• VSA-2026-062: Empty-object login token docs.vates.tech · Advisory · 2026-11-10
• Vates 2026 security advisories index docs.vates.tech · Vendor report
• XCP-ng security and maintenance updates (Vates/XCP-ng project blog, product context) xcp-ng.org · Vendor report
• fix(xo-server): validate authentication token IDs (PR #10748) GitHub · Code repository · 2026-11-10
• Xen Orchestra source repository GitHub · Code repository
• Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers BleepingComputer · News · 2026-11-10

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Previous and next in vulnerability

• SAP patches ICM2SHELL and PROXYGATE maximum severity flaws (CVE-2026-76964, CVE-2026-120017, CVE-2026-89103, CVE-2026-89126) Previous report
• SSHole (CVE-2026-123158) - OpenSSH on musl-based Linux oversized password authentication bypass, exploited in the wild Next report