From: Ming Lu <ming.lu@citrix.com>
Subject: CA-430074: Don't take bridge from an import for network creation

When VM.import decides to create a network that doesn't exist on this
pool, the original bridge is meaningless to this pool. So make
Network.create choose the bridge, and always create a managed
network.

This also eliminates the bypass of the bridge_blacklist.

This is CVE-2026-102707, part of XSA-530.

Signed-off-by: Ming Lu <ming.lu@citrix.com>
Reviewed-by: Andrii Sultanov <andriy.sultanov@vates.tech>

diff --git a/ocaml/xapi/import.ml b/ocaml/xapi/import.ml
index 080582b47309..9a2254e13998 100644
--- a/ocaml/xapi/import.ml
+++ b/ocaml/xapi/import.ml
@@ -1284,6 +1284,12 @@ module Net : HandlerTools = struct
            originating session. *)
         Xapi_network_helpers.assert_protected_map_keys_allowed ~__context
           ~field_name:"other_config" ~value:net_record.API.network_other_config ;
+        (* The bridge from the import is meaningless to this pool.
+           Network.create will choose the bridge. A network created during
+           import must be a managed one. *)
+        let net_record =
+          {net_record with API.network_bridge= ""; network_managed= true}
+        in
         let net =
           log_reraise
             ("failed to create Network with name_label "