Live › vulnerability › GHSA-5wf9-h793-w73c
Go to dashboardThe pinnedPeerCertSha256 setting in xray-core can be bypassed when a CA certificate is pinned, so a man-in-the-middle attacker can intercept TLS connections. The sources do not say what the attacker can read or change beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/xtls/xray-core | go | >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9 | 1.260327.1-0.20260710210335-64fada32b5b9 |
Check go.mod for github.com/xtls/xray-core and look for pinnedPeerCertSha256 in your Xray config files.
Upgrade github.com/xtls/xray-core to 1.260327.1-0.20260710210335-64fada32b5b9 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
This page as .md · .json · in your agent: get_signal("GHSA-5wf9-h793-w73c")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.