ZDF
Sign inSign up

Vulnerabilities

Vulnerability · GHSA-5wf9-h793-w73c

Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

Published Oct 2, 2026 · catalog updated Oct 20, 2026 · Xray-core: Pinning a CA

Open the advisory

Exploitation likelihood is not on this record for GHSA-5wf9-h793-w73c. A missing EPSS score is not a low risk. Compare Xray-core: Pinning a CA with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Xray-core: Pinning a CA).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
High—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Advisory link
Affected products
Go github.com/xtls/xray-core

### Summary Pinning a CA certificate via can lead to the success of MITM attacks in some cases. ### Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If is empty, will be empty and will not verify against dNSName or iPAddress. If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections. In Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the . If the user specifies , InsecureSkipVerify will always be true so ServerName can be empty. In most cases, if the user does not specify the , Xray-core will use the server address as the . Thanks to , ServerName will usually not be empty. However, there are some leftovers: - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348 without . - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142 without . Although ServerName will not be empty if is a domain name, ServerName will be left empty if is an IP address. ServerName is not equivalent to SNI. > ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address. In these cases, if the user does not specify the , Xray will not use the server address as the and will be left empty. ### PoC client.json server.json Both and are issued by the same CA. is subjected to 127.0.0.1. is subjected to 127.0.0.2. server1.crt server2.crt server2.key Expected behavior: The client will fail to establish the connection. Actual behavior: The client succeeds in establishing the connection. ### Impact Xray-core from v26.1.13 to the latest version

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/xtls/xray-core1.260113.0 → 1.260327.1-0.20260710210335-64fada32b5b9

How to fix GHSA-5wf9-h793-w73c

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-5wf9-h793-w73c. A missing EPSS score is not a low risk. Compare Xray-core: Pinning a CA with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 1.260113.0 → 1.260327.1-0.20260710210335-64fada32b5b9. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-297. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 2, 2026 · GitHub Advisory Database

    Detected

    ### Summary Pinning a CA certificate via can lead to the success of MITM attacks in some cases. ### Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If is empty, will be empty and will not verify against dNSName or iPAddress. If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate

  2. Oct 20, 2026 · GitHub Advisory Database

    Fix available

    github.com/xtls/xray-core fixed in 1.260327.1-0.20260710210335-64fada32b5b9

  3. Oct 20, 2026 · GitHub Advisory Database

    Fix available

    github.com/xtls/xray-core fixed in 1.260327.1-0.20260710210335-64fada32b5b9

  4. Oct 20, 2026 · GitHub Advisory Database

    Updated

    ### Summary Pinning a CA certificate via can lead to the success of MITM attacks in some cases. ### Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If is empty, will be empty and will not verify against dNSName or iPAddress. If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate

Sources

References

Freshness

Last verified in this catalog Oct 20, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.