In versions of Incus prior to 7.0.0, the OVN database connection logic uses custom TLS peer‑certificate verification that disregards the configured CA root and instead accepts any certificate chain supplied by the peer during the handshake. This flaw enables an active attacker who can intercept or impersonate the OVN endpoint on the management network to present a rogue self‑signed certificate, which the system will treat as valid. The result is that the attacker can read, modify, or drop traffic to the OVN database and gain unauthorized control over virtual networking for both containers and virtual machines.

The vulnerability affects the Incus container and virtual machine manager provided by the lxc:incus vendor. Versions earlier than 7.0.0 are impacted; Incidentally, only deployments that use the SSL database connection paths are susceptible. All other versions and vendors are not affected.

The CVSS score of 2.3 indicates a low severity impact, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker in a position to intercept the OVN control plane connection, such as within the same subnet or with compromised network equipment. Once in position, no additional user privileges are needed, and the attacker can impersonate the OVN endpoint without detection.