Xen XAPI Fixes Pool-Secret Timing Exposure
Tech GuruQuick Answer
Update XAPI on every pool member, verify all members are fixed, then rotate the Pool Secret using the supported xe pool-secret-rotate procedure.
Confirm Scope And Apply The Supported Remediation
What to do now: Record host and pool owners, installed Xen or XAPI versions, relevant hardware, roles and maintenance dependencies. Inventory XAPI across the entire pool and compare each vendor build with the XSA-529 fix; Xen does not list a numbered fixed release. Apply the supported build or attached XSA-529 patch. Rotate the Pool Secret only after all pool members have received the fixed XAPI. No mitigation is listed. Confirm pool health and inter-host authentication, verify the rollout on every member, and retain version and rotation records without recording the secret.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | XAPI pool authentication |
|---|---|
| Advisory | XSA-529 |
| CVE | CVE-2026-102705 |
| Authoritative release date | November 10, 2026 at 18:00, from the Xen public-release timeline. |
| Authority revision date | November 10, 2026 at 18:00, from the Xen advisory revision field. |
| Affected versions | All versions of XAPI before the XSA-529 fix. A data-dependent token comparison may allow an unauthenticated attacker to infer the Pool Secret and gain full pool access. |
| Fixed version | XAPI incorporating xsa529.patch, followed by Pool Secret rotation after all members are fixed |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Xen does not state malicious exploitation in this advisory.; no exploitation claim is inferred. |
What Changed
XAPI used a comparison with data-dependent timing for the bearer token that authenticates requests between pool hosts.
What To Validate Now
- Inventory. Record host and pool owners, installed Xen or XAPI versions, relevant hardware, roles and maintenance dependencies.
- Establish applicability. Inventory XAPI across the entire pool and compare each vendor build with the XSA-529 fix; Xen does not list a numbered fixed release.
- Remediate. Apply the supported build or attached XSA-529 patch. Rotate the Pool Secret only after all pool members have received the fixed XAPI. No mitigation is listed.
- Validate. Confirm pool health and inter-host authentication, verify the rollout on every member, and retain version and rotation records without recording the secret.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate pool-wide maintenance and preserve authentication logs. Avoid logging or copying the Pool Secret into change records.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
