CVE-2026-40243: Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots

Broken TLS validation logic in the OVN database connection logic could allow connections to an attacker’s OVN database.

OVN uses mTLS for authentication, so the attacker cannot actually perform a full man in the middle attack as they won’t be able to authenticated with the real OVN deployment. At best they can provide a replacement empty database which Incus will briefly interact with before hitting errors due to the rest of the OVN stack not reacting to the committed changes.

Also worth noting that the OVN control plane is typically run on the same servers that run Incus, there is typically no routing involved between an Incus server and the OVN control plane, making such an attack extremely difficult to pull off in the first place.