--- id: GHSA-5wf9-h793-w73c title: >- Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks summary: >- Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks severity: high cwe: - CWE-297 vendor: xtls product: github.com/xtls/xray-core ecosystem: go affected: - >- github.com/xtls/xray-core >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9 patched: - github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9 published: '2026-10-02' updated: '2026-10-02' sourceUpdated: '2026-10-02T22:35:52Z' source: GHSA sourceUrl: 'https://github.com/advisories/GHSA-5wf9-h793-w73c' references: - url: 'https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c' - url: 'https://github.com/XTLS/Xray-core/pull/6472' - url: >- https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5 - url: 'https://github.com/XTLS/Xray-core/releases/tag/v26.7.11' - url: 'https://github.com/advisories/GHSA-5wf9-h793-w73c' tags: - ghsa - go ingestedAt: '2026-10-02T23:34:57.406Z' --- ## Overview ### Summary Pinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases. ### Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress. If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections. In Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so ServerName can be empty. In most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`. Thanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty. However, there are some leftovers: - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348 `GetTLSConfig()` without `tls.WithDestination(dest)`. - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142 `GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address. ServerName is not equivalent to SNI. > ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address. In these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty. ### PoC
client.json ```json { "log": { "loglevel": "debug" }, "inbounds": [ { "listen": "127.0.0.1", "port": 1080, "protocol": "socks" } ], "outbounds": [ { "protocol": "hysteria", "settings": { "address": "127.0.0.1", "port": 443, "version": 2 }, "streamSettings": { "security": "tls", "network": "hysteria", "tlsSettings": { "pinnedPeerCertSha256": "e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f" }, "hysteriaSettings": { "version": 2, "auth": "auth" } } } ] } ``` server.json ```json { "log": { "loglevel": "debug" }, "inbounds": [ { "listen": "127.0.0.1", "port": 443, "protocol": "hysteria", "settings": { "version": 2 }, "streamSettings": { "security": "tls", "network": "hysteria", "tlsSettings": { "certificates": [ { "certificateFile": "server2.crt", "keyFile": "server2.key" } ] }, "hysteriaSettings": { "version": 2, "auth": "auth" } } } ], "outbounds": [ { "protocol": "freedom" } ] } ``` Both `server1.crt` and `server2.crt` are issued by the same CA. `server1.crt` is subjected to 127.0.0.1. `server2.crt` is subjected to 127.0.0.2. ``` xray tls hash --cert server1.crt Leaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d CA SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f xray tls hash --cert server2.crt Leaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c CA SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f ``` server1.crt ``` -----BEGIN CERTIFICATE----- MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0 MzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60 6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K cZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB S3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI y344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb y/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A AAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR L3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD e6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw M30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy U5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS /v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ 29bSzHij -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7 dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN 3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru 6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36 y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN /l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7 6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs 6+IZCAM= -----END CERTIFICATE----- ``` server2.crt ``` -----BEGIN CERTIFICATE----- MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1 MjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz WL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al 1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q ZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW HLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H ORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A AAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm z7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I L/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5 Vn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u t7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7 t5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX DfQWbk1o -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7 dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN 3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru 6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36 y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN /l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7 6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs 6+IZCAM= -----END CERTIFICATE----- ``` server2.key ``` -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCY7k8ekjoME6rm zlkxs03+YkN5ykcmAh8qZnMgyygEmlfZ+vqA81i/S6fYkeLjqzsjq9unrvG7nf8g ZxYkc/KQD++IsYxSD/LYA2XknuK6/+IwCovwJdToUEo7ysmiKUs+LjOB9/XUMA8i 9oSZyg2JlGuyefNm9hIGFO766Omb4nwiIf4tKmSIFTiXVpI0/sfMQMX6lt/4QtHA NNwI3N1wTxARjkwEmXGvCE9dLHYFIgRjBzHgVhyy88/POxHaT5/OuLMuXEI+dPXp BD+43NxAcZ8cKasqpLa/kPofBMVjOwlSMvWfhzkU9k8c8Xn6GBWNvGuj+1SdjTZ0 SRYCKT39AgMBAAECggEABa+oq/GSbHQHwPSvrtAkqH51VVAu1Iw0JfKwuamsF324 of95tHU32ccBmuUTu1TYylL/xAyWatwtSgJjOaBBBte814eIeN2kcSExNu6sbfkJ KzGdMeTqNWgU1oPL+vZPmKSFoEG8t3LBAVMKq6AuYCzvUy/DG9Mu6OB64UPrObND neXZT8YZ2Ux0vEV9BAc0z+9tdWVjBy+l5ei6wpjhP69GZiVOsLmKTg/MDT4FN+Pi WJbyHcL1IKTRxxNxDPInBKhEMrxKKAABeXlp5nwnz0gkgUoxK3YHZmxAPr6yCcHP ffeMjpE5BaRKzhimKrOJB4LUES24ltjo+5v5GmZzYQKBgQDSbhiNQpmhOk4ICzwJ 8DMCAigaDm2cD/qC66OFrHhQfr7EC9MRKKC/8WlZYgNepxZ1ZM95+GJu5aTsh7d2 HknwJkxkbTadfRcch9HQun68Y814G0LBDuDRRc9OnBQW6Gr4jTFDP+uqQl6gAfu4 QOjATymrRa5S/21MkQ3Ryb5H4QKBgQC6DI1ETmfvXCOVpEUM9IjeEbiAjVYbUjBL GEOhE0izOv8mjSEgifMSEXJMn58F4nW/UoxtDobTAhQ/WO5BUVCEeQnOAXhV57jU /t/fBbdC7nrVnfFl9KmsOV3LcxUo0yE/x7UiHd1QlwtOTl1KPFQa9WpSehxjjQAS mHYM5PhJnQKBgQCIGHCEm/hkkCL7jNiNzO4QdHifMYmuj58DoYcm4z8FQJP8k3E0 /cPJoEb0ajGnvAUIc+TEC+MNujSKTdRX7or/aKWrpf7WqJqT9zu59YQWL64p6eeo mQjKEI5dVxCfKD5W9mpQBj1S5o3wipfUuRZPmmNmxDBUuaJlDMOVVRddwQKBgCUl bmst8GiFEAHHq5W7mTwlc54PGhsYXNYRgSc+72wBooHy+aNCh8qauyR7VkfZgELz 21/G37pvltVTDzbxYk8gz4lXF8ynGGtGfDJONNnjPZk7EMCXiez+AzEkyBu/k8rl N9AZAGAf2D0JPm0dAHnleBYBlXt24oXT9PX8HWqtAoGBALRX6V1U+bKwMih3N21b 1w/ELI7L1BBAPqJxiQPSOa7kshamZgFenbH1wFLIXz6YwaEOOmYiId6lFjcJaBbF +R4HfxBhOuY6cvD0vEROIRntaqsj4zJXahlZZ9uG1EAYrY2tGKkCUMKN2IBE+WWS 3YTH4WIOsCZriuaHIAyjsCcv -----END PRIVATE KEY----- ```
Expected behavior: The client will fail to establish the connection. Actual behavior: The client succeeds in establishing the connection. ### Impact Xray-core from v26.1.13 to the latest version ## Affected packages - `github.com/xtls/xray-core >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9` ## Remediation Upgrade to a patched release: - `github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9`