Detections
Analytics

SCA: security update for github.com/lxc/incus/v6/cmd/incusd (GHSA-c839-4qxr-j4x3)

low Tenable Cloud Security Plugin ID 441057

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation
 logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN
 client implementations disable Go standard TLS server verification and replace it with custom peer-
 certificate verification logic. That replacement verifier does not anchor trust in the configured CA
 certificate. Instead, it constructs the verification root set from certificates supplied by the peer
 during the handshake, so the configured CA is parsed but not used as the trust anchor for the final
 verification decision. In OVN-enabled deployments that use these SSL database connection paths, an
 attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue
 self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the
 intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active
 attacker in a suitable network position. This issue is fixed in version 7.0.0. (CVE-2026-40243)

Solution

Update the github.com/lxc/incus/v6/cmd/incusd library and its related packages to version 7.0.0 or later.

See Also

https://github.com/advisories/GHSA-c839-4qxr-j4x3

Plugin Details

Severity: Low

ID: 441057

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 5/4/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.8

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-40243

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.3

Threat Score: 1.3

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/4/2026

Vulnerability Publication Date: 5/4/2026

Reference Information

CVE: CVE-2026-40243