medium 4.8

CVE-2026-40243 json

Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation

published 2026-05-04 6mo ago modified 2026-10-26 14d ago also EUVD-2026-28211 , GHSA-c839-4qxr-j4x3 , GO-2026-5319

cvss: 4.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision.

In OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0.

Patch / fix

fixed in 3 distros 3

go github.com/lxc/incus/v6/cmd/incusd 7.0.0
go github.com/lxc/incus/v7 7.0.0
linuxcontainers incus 7.0.0

debian opensuse alpine

incus Debian 13 6.0.4-2+deb13u7
incus Debian 14 7.0.0-1

debian advisories DEBIAN-CVE-2026-40243

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

incus Alpine 3.24 7.0.0-r0

alpine advisories ALPINE-CVE-2026-40243

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-40243 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40243 updated 2026-05-15 cvss 4.8

github.com/lxc/incus: incus: Incus: Authentication bypass due to broken OVN TLS validation

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 6mo ago (2026-05-07)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.3	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
GitHub	3.1	2.3	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CNA	4.0	2.3	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/lxc/incus/v6/cmd/incusd	<7.0.0	7.0.0
go	github.com/lxc/incus	all versions	no fix listed
go	github.com/lxc/incus/v6	all versions	no fix listed
go	github.com/lxc/incus/v7	<7.0.0	7.0.0

Affected products

lxc incus

Classification

Weakness

CWE-295 Improper Certificate Validation
CWE-287 Improper Authentication

References

github.com /lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3
exploit, web, vendor-advisory, advisory
github.com /lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go
web, product
github.com /lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go
web, product
github.com /lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go
web, product
github.com /lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go
web, product
nvd.nist.gov /vuln/detail/CVE-2026-40243
advisory
github.com /lxc/incus
package

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.