PT-2026-37102 · Incus · Incus

Stamparm · Published 2026-05-04 · Updated 2026-05-07 · CVE-2026-40243

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.0.0

Description Broken TLS validation logic in the OVN database connection logic allows connections to an attacker's OVN database. The OVN client implementations disable standard Go TLS server verification and use a custom peer-certificate verification logic that fails to anchor trust in the configured CA certificate. Instead, the system constructs the verification root set from certificates supplied by the peer during the handshake, meaning the configured CA is parsed but ignored for the final verification decision.

In OVN-enabled deployments using these SSL database connection paths, an attacker capable of impersonating or intercepting the OVN endpoint on the management network can present a rogue self-signed certificate chain, which Incus will accept as valid. This affects authenticated connections to the OVN northbound and southbound databases, which serve as authoritative control-plane interfaces for logical network configuration and distribution. This failure in the CA-based trust model permits endpoint impersonation by an active attacker in a suitable network position.

Recommendations Update to version 7.0.0.

Exploit

Fix

Improper Certificate Validation

Improper Authentication

Weakness Enumeration

CWE-295

CWE-287

Related Identifiers

CVE-2026-40243

GHSA-C839-4QXR-J4X3

Affected Products

Incus

References · 17

• 🔥 https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-40243 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40243 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40243 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40243 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c839-4qxr-j4x3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40243 · Vendor Advisory
• https://github.com/lxc/incus · Note
• https://github.com/lxc/incus/pull/3273 · Note
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go · Note
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go · Note
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go · Note
• https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go · Note
• https://twitter.com/VulmonFeeds/status/2052248560666554763 · Twitter Post