lxc incus up to 6.x OVN Endpoint certificate validation

Summaryinfo

A vulnerability, which was classified as critical, has been found in lxc incus up to 6.x. This impacts an unknown function of the component OVN Endpoint. The manipulation leads to certificate validation. This vulnerability is listed as CVE-2026-40243. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in lxc incus up to 6.x and classified as problematic. This issue affects an unknown functionality of the component OVN Endpoint. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. The summary by CVE is:

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision. In OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-40243 since 04/10/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

Upgrading to version 7.0.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• lxc

Name

• incus

Version

• 6.x

Website

• Product: https://github.com/lxc/incus/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion