CVE-2026-40243

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40243", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T17:31:45.785Z", "datePublished": "2026-05-06T20:38:22.590Z", "dateUpdated": "2026-05-07T14:03:42.997Z"}, "containers": {"cna": {"title": "Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3"}, {"name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go"}, {"name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go"}, {"name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go"}, {"name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go"}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"version": "< 7.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-06T20:38:22.590Z"}, "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision.\n\nIn OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0."}], "source": {"advisory": "GHSA-c839-4qxr-j4x3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T14:02:44.630167Z", "id": "CVE-2026-40243", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T14:03:42.997Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation", "source": {"advisory": "GHSA-c839-4qxr-j4x3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "ADJACENT", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.0.0"}]}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3", "name": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go", "name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go", "name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go", "name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go", "name": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision.\n\nIn OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-06T20:38:22.590Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40243", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T14:02:44.630167Z"}}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-07T14:02:07.269Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-40243", "state": "PUBLISHED", "dateUpdated": "2026-05-06T20:38:22.590Z", "dateReserved": "2026-04-10T17:31:45.785Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-06T20:38:22.590Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "incus", "vendor": "lxc", "versions": [{"status": "affected", "version": "< 7.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF8EBB4B-C1F0-44C5-B063-9CF8EB6E0972", "versionEndExcluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision.\n\nIn OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. En versiones anteriores a la 7.0.0, una l\u00f3gica de validaci\u00f3n TLS defectuosa en la l\u00f3gica de conexi\u00f3n de la base de datos OVN puede permitir conexiones a la base de datos OVN de un atacante. Las implementaciones del cliente OVN deshabilitan la verificaci\u00f3n est\u00e1ndar del servidor TLS de Go y la reemplazan con una l\u00f3gica de verificaci\u00f3n de certificado de par personalizada. Ese verificador de reemplazo no ancla la confianza en el certificado de CA configurado. En su lugar, construye el conjunto ra\u00edz de verificaci\u00f3n a partir de certificados proporcionados por el par durante el handshake, por lo que la CA configurada se analiza pero no se utiliza como ancla de confianza para la decisi\u00f3n de verificaci\u00f3n final.\n\nEn despliegues habilitados para OVN que utilizan estas rutas de conexi\u00f3n de base de datos SSL, un atacante capaz de suplantar o interceptar el endpoint OVN en la red de gesti\u00f3n puede presentar una cadena de certificados autofirmados maliciosos, e Incus aceptar\u00e1 este certificado como v\u00e1lido. Este problema anula el modelo de confianza basado en CA previsto para las conexiones de la base de datos OVN y permite la suplantaci\u00f3n de endpoints por parte de un atacante activo en una posici\u00f3n de red adecuada. Este problema est\u00e1 solucionado en la versi\u00f3n 7.0.0."}], "id": "CVE-2026-40243", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40243", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T14:02:44.630167Z", "version": "2.0.3"}}]}, "published": "2026-05-06T21:16:01.070", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "lxc"}], "created": "2026-05-06T22:30:13.703062+00:00", "updated": "2026-05-06T22:45:13.565590+00:00", "vendors": ["lxc", "lxc$PRODUCT$incus"]}