Xen Security Advisory 529 v2 (CVE-2026-102705) - XAPI: data-dependent compare function used for Pool Secret
Merged summary · from the lead articleSummaries by Vani AI
XSA-529 version 2 is the public release of an issue in the bearer token that authenticates hosts in a Xen pool.
The Xen.org security team published Xen Security Advisory 529 version 2 for CVE-2026-102705. XAPI compares its Pool Secret, a bearer token used to authenticate requests between hosts in a pool, with a data-dependent compare function. The available text ends before describing that function, affected versions, or a fix.
Key facts
- Version 2 of XSA-529 is marked as the public release.
- The Pool Secret authenticates requests between hosts in a pool.
- No fixed version or exploitation status appears in the available text.
Coverage
oldest first · one row per article · UTC- · 10h ago
oss-securityFirst report
Xen XAPI compares Pool Secret with a data-dependent function (CVE-2026-102705)
XSA-529 version 2 is the public release of an issue in the bearer token that authenticates hosts in a Xen pool.
- · 10h ago
Xen publishes XSA-530 on multiple XAPI RBAC issues
Version 2 makes five CVE-tracked XAPI role issues public; versions and fixes are not stated.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102705 | — | — | — | ||
| CVE-2026-102706 | — | — | — | ||
| CVE-2026-102707 | — | — | — | ||
| CVE-2026-102708 | — | — | — | ||
| CVE-2026-119779 | — | — | — | ||
| CVE-2026-119780 | — | — | — |