CVE-2026-40243

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision. In OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0.

• CWE-295

• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.goProduct
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.goProduct
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.goProduct
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.goProduct
• https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3Exploit, Vendor Advisory
• https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3Exploit, Vendor Advisory

Published

May 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40227In systemd 260 before 261, a local unprivileged user can tri…5.5
• CVE-2026-40228In systemd 259, systemd-journald can send ANSI escape sequen…3.3
• CVE-2026-40229Helpy contains a stored cross-site scripting vulnerability i…5.4
• CVE-2026-40230Helpy contains a stored cross-site scripting vulnerability i…5.4
• CVE-2026-4024The Royal Addons for Elementor plugin for WordPress is vulne…5.3
• CVE-2026-40242Arcane is an interface for managing Docker containers, image…6.5
• CVE-2026-40244OpenEXR provides the specification and reference implementat…7.1
• CVE-2026-40245Free5GC is an open-source Linux Foundation project for 5th g…7.5
• CVE-2026-40246free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-40247free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-40248free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-40249free5GC is an open-source implementation of the 5G core netw…5.3