VSA-2026-023: XAPI Missing TLS verification in some SDKs (CVE-2026-42491 / XSA-498)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-15 | 2026-07-15 | ⚪ N/A | Not available yet | - None (SDK not used) |
The Xen project recently disclosed a vulnerability affecting the C# and PowerShell SDKs shipped with XAPI and published XSA-498. For Vates products, this vulnerability is not applicable: the SDK is packaged inside XCP-ng but is not directly used by the product. Third-party users of the SDK should build from the master branch of XAPI for official upstream support.
For details on how we assign severity levels, see our Severity Levels Explained page.
Summary
A missing TLS certificate verification vulnerability in the XAPI .NET and PowerShell SDK bindings can lead to an improper TLS verification. Other languages are not impacted.
Impact
A malicious actor able to perform a Man-in-the-Middle attack on the network communication between a program using one of the affected SDKs and a host running XAPI may be able to intercept the communication and:
- Steal a session token, allowing for hijack of the administrative session
- Read or tamper with all operations going through XAPI requests
No impact for XCP-ng or Xen Orchestra: these SDKs are not used.
Affected Versions
- XCP-ng 8.3: Not affected. The SDK is packaged but not used directly by Vates products.
- Xen Orchestra: Does not rely on these SDKs and is not impacted.
Mitigation
Third-party applications consuming the XAPI SDKs should switch to building from the master branch of XAPI, which includes the upstream fix and receives official upstream support. The SDK packaged inside XCP-ng is provided for convenience and is not the officially supported distribution channel. As of 2026-07-15 upstream does not plan to update the support branch used in XCP-ng 8.3.
XenCenter and xcp-ng-center are not Vates products, but they are impacted as they are using the .NET SDK.
- XenCenter has been updated to fix the issue.
- Vates is trying to reach the maintainer of xcp-ng-center to help include the fix.
Resolution
This advisory does not affect any Vates products. No action is required.
Credits
This issue was discovered by the Veeam Team.