medium
advisory
Xen Project: XAPI Pool Secret comparison vulnerability (CVE-2026-102705)
The Xen Project has disclosed that the XAPI component, which uses a Pool Secret for authenticating requests between hosts in a pool, performs token comparisons using a data-dependent function.
CVE search metadata
CVE search record: CVE-2026-102705. KEV: no. Product: XAPI. Brief: Xen Project: XAPI Pool Secret comparison vulnerability (CVE-2026-102705). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xapi-timing-side-channel/
Triage facts
Revision 1- Applicability
- XAPI
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 01:38 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unknown
Xen Security Advisory XSA-529 identifies that the XAPI component uses a data-dependent comparison function for the Pool Secret, a bearer token used to authenticate requests between hosts in a pool.