Xen XAPI compares Pool Secret with a data-dependent function (CVE-2026-102705)
Original title: Xen Security Advisory 529 v2 (CVE-2026-102705) - XAPI: data-dependent compare function used for Pool Secret
XSA-529 version 2 is the public release of an issue in the bearer token that authenticates hosts in a Xen pool.
The Xen.org security team published Xen Security Advisory 529 version 2 for CVE-2026-102705. XAPI compares its Pool Secret, a bearer token used to authenticate requests between hosts in a pool, with a data-dependent compare function. The available text ends before describing that function, affected versions, or a fix.
Unconfirmed: The feed cuts off before the function's effect, affected versions, fixes, and exploitation status.
- Version 2 of XSA-529 is marked as the public release.
- The Pool Secret authenticates requests between hosts in a pool.
- No fixed version or exploitation status appears in the available text.
Impact: Data-dependent comparison of the pool authentication secret
| Product | Affected |
|---|---|
| Xen XAPI | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102705 | — | — | — |
From the original article
Posted by Xen . org security team on Nov 10 Xen Security Advisory CVE-2026-102705 / XSA-529 version 2 XAPI: data-dependent compare function used for Pool Secret UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= XAPI has a bearer token used to authenticate requests made between hosts in a pool, known as the Pool Secret.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.