{"id":"GHSA-5wf9-h793-w73c","kind":"vulnerability","aliases":["GHSA-5wf9-h793-w73c","GO-2026-6651"],"related":[],"title":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","description":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","summary":"The pinnedPeerCertSha256 setting in xray-core can be bypassed when a CA certificate is pinned, so a man-in-the-middle attacker can intercept TLS connections. The sources do not say what the attacker can read or change beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/xtls/xray-core","fixed":["1.260327.1-0.20260710210335-64fada32b5b9"],"affected":">= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","xray-core"],"not_affected_if":["default-config"],"how_to_check":"Check go.mod for github.com/xtls/xray-core and look for pinnedPeerCertSha256 in your Xray config files.","fix":"Upgrade github.com/xtls/xray-core to 1.260327.1-0.20260710210335-64fada32b5b9 or later.","status":"open","published_at":"2026-10-20T00:20:45+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:22+00:00","updated_at":"2026-10-23T20:15:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:22Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/xtls/xray-core to 1.260327.1-0.20260710210335-64fada32b5b9 or later.\nunknown","summary":"The pinnedPeerCertSha256 setting in xray-core can be bypassed when a CA certificate is pinned, so a man-in-the-middle attacker can intercept TLS connections. The sources do not say what the attacker can read or change beyond that.","category":"package","who_cares":["go","xray-core","self-hosted"],"confidence":0.6,"analyst_note":"Confirm the exact pinning config that triggers the bypass and whether default configs are affected; see https://pkg.go.dev/vuln/GO-2026-6651.","how_to_check":"Check go.mod for github.com/xtls/xray-core and look for pinnedPeerCertSha256 in your Xray config files.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000376,"input_tokens":2069,"output_tokens":338,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':25A '-6651':26A '/xtls/xray-core':18A,34A,101C '5wf9':21A,29A 'attack':14A,66B,78B,97C 'beyond':83B 'bypass':52B 'ca':3A,55B,86C 'certif':4A,56B,87C 'chang':82B 'connect':70B 'core':42B,49B 'ghsa':20A,28A 'ghsa-5wf9-h793-w73c':19A,27A 'github.com':17A,33A,100C 'github.com/xtls/xray-core':16A,32A,99C 'go':24A,35B 'h793':22A,30A 'host':39B 'intercept':68B 'lead':8A,91C 'man':62B 'man-in-the-middl':61B 'middl':65B 'mitm':13A,96C 'packag':36B 'pin':1A,58B,84C 'pinnedpeercertsha256':6A,44B,89C 'read':80B 'say':75B 'self':38B 'self-host':37B 'set':45B 'sourc':72B 'success':11A,94C 'tls':69B 'via':5A,88C 'w73c':23A,31A 'xray':41B,48B 'xray-cor':40B,47B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:20:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6651","url":"https://pkg.go.dev/vuln/GO-2026-6651","severity":null,"published_at":"2026-10-20T00:20:45+00:00","modified_at":"2026-10-20T00:20:45+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}