November 2026 Security Updates #3 for XCP-ng 8.3 LTS
New security updates are available for XCP-ng 8.3 LTS.
Host reboots are necessary after this update.
XCP-ng's updates are cumulative, so applying updates now will also apply any previous updates that weren't applied to your hosts. Update advisories: https://xcp-ng.org/blog/tag/update/.
Summary
Security vulnerabilities have been detected and fixed in XAPI, the control plane of XCP-ng, in the EDK2 (OVMF) UEFI firmware, and in the Linux kernel (the Xen PV network and block backends). Several are critical and we advise updating as soon as your schedule permits.
Security Updates
XAPI
XSA-529: data-dependent compare function used for Pool Secret [critical]
XAPI uses a bearer token, known as the Pool Secret, to authenticate requests made between the hosts of a pool. The comparison of this token was performed with a function whose timing depends on the data being compared, which could be used as a timing oracle by an unauthenticated attacker on the pool management network.
An unauthenticated attacker may be able to infer the value of the Pool Secret, and gain full access to the pool.
xe pool-secret-rotate, that part is done live and does not require any restart of the toolstack.References: VSA-2026-057, CVE-2026-102705, XSA-529
XSA-530: multiple RBAC issues [moderate]
XAPI can configure different users with different roles, using Role Based Access Control (RBAC). Some earlier restrictions were found to not cover every API call, and this update closes the identified gaps.
An authenticated user holding a restricted administrator role (pool-operator, vm-power-admin or vm-admin) could use these gaps to escalate their privileges to pool-admin. Any authenticated user, even with the read-only role, could also force-fail tasks of more privileged roles.
References: VSA-2026-058, CVE-2026-102706, CVE-2026-102707, CVE-2026-102708, CVE-2026-119779, CVE-2026-119780, XSA-530
EDK2
CVE-2026-97631: pre-boot remote code execution in the PXE driver [moderate]
The PXE Base Code driver of EDK2 (OVMF), the firmware used for booting UEFI guests, contained an out-of-bounds write when handling ICMP error messages during a network boot. An unauthenticated attacker on the network could deliver a single oversized unicast ICMP error message to a guest PXE-booting over IPv4 or IPv6, and use it to corrupt the firmware's memory and, on a known firmware build, execute arbitrary code before the operating system loads, when Secure Boot or Measured Boot has verified nothing yet.
The exposure is limited to UEFI guests that PXE-boot, and only during the PXE boot window, so it does not affect running VMs and the new firmware applies the next time a VM boots with UEFI firmware.
References: VSA-2026-059, CVE-2026-97631, GHSA-99cj-7hg9-mp4m
This update also brings in the remaining security patches from the XenServer EDK2 release it syncs with, and updates the bundled Brotli library to fix related security issues.
References: CVE-2026-45447, CVE-2022-36763, CVE-2022-36764, CVE-2019-14560, CVE-2024-38797, CVE-2024-38796
Kernel
XSA-526, XSA-527, XSA-531: use-after-free in the Xen network backend [critical]
Three use-after-free vulnerabilities affect xen-netback, the part of the dom0 kernel that serves a guest's virtual network interface. While the interface is torn down, the driver frees data that may still be read: statistics data on a failed connection (XSA-526, and XSA-531, which closes a gap in the first fix), and the multicast address list (XSA-527).
The most likely outcome is a Denial of Service (DoS) of the whole host by a malicious guest, but information leaks and, although unlikely, privilege escalation cannot be ruled out.
References: VSA-2026-060, CVE-2026-100080, CVE-2026-100081, CVE-2026-99286, XSA-526, XSA-527, XSA-531
XSA-528: use-after-free in the Xen block backend [XCP-ng not impacted in default configuration]
XCP-ng 8.3: the in-kernel block backend is not used by default, so a standard XCP-ng deployment is not exposed to it. The fix is included to stay aligned with upstream.
References: VSA-2026-061, CVE-2026-100082, XSA-528
We want to thank everyone who was involved in preparing these updates, including XCP-ng’s user community, who tested the parts of this release that weren’t under embargo.
