VSA-2026-057: Data-dependent compare function used for Pool Secret (CVE-2026-102705 / XSA-529)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-11-10 | 2026-11-10 | ⚫ Critical | Not available yet | - XCP-ng 8.3 |
The Xen Project has disclosed a vulnerability in XAPI, allowing an unauthenticated attacker to gain full access to the pool. For Vates products, we classify the impact as Critical. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary
XAPI has a bearer token used to authenticate requests made between hosts in a pool, known as the Pool Secret.
Comparison of this token is performed with a function which has data-dependent timing. An attacker may be able to use this as a timing oracle to infer the value of the Pool Secret.
Impact
An unauthenticated attacker may be able to infer the value of the Pool Secret, and gain full access to the pool.
Status
- Released
Affected Versions
- XCP-ng 8.3: Affected.
Mitigation
There are no mitigations.
Resolution
- An
xe-toolstack-restartis needed for this to take effect. - After deploying the fixed XAPI to all pool members, users are strongly encouraged to regenerate the Pool Secret by running
xe pool-secret-rotate. This runs live and does not require a toolstack restart. - This command will fail if HA is enabled or if there are ongoing tasks on the pool.
As of 2026-11-10, the xapi package for XCP-ng 8.3 has been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xapi-26.1.21-1.4.xcpng8.3
Credits
Thanks to the Xen Project and the XAPI team for their work on this vulnerability and the patch to fix it.