🔒Xray-core Vulnerability Bypassed for 6 Months
Xray-core's Security Flaw Wasn't Just Missed, It Was Hidden
TL;DR
A critical security flaw in Xray-core was hidden for half a year, allowing attackers to bypass certificate verification. The vulnerability was fixed on Feb 6, 2026, but the damage was done.
A critical security vulnerability in Xray-core was covered up for nearly half a year, allowing attackers to bypass certificate verification and insert a leaf certificate at any point in the chain. If you're using Xray-core for secure communications, this is a big deal. The vulnerability was introduced on Jan 9, 2026, and only fixed on Feb 6, 2026, after being privately reported to maintainers. The fix was incomplete, and the vulnerability could still be exploited under certain conditions. The vulnerability was reported via GitHub Security Advisory on July 3, 2026, revealing the extent of the issue.
Key Points
Xray-core's security flaw was introduced on Jan 9, 2026, and covered up for half a year.
The vulnerability was fixed on Feb 6, 2026, but the fix was incomplete and could still be bypassed.
The vulnerability was privately reported to Xray-core maintainers on Feb 6, 2026, and publicly disclosed on July 3, 2026.
The pinnedPeerCertificateChainSha256 option was removed on Jan 9, 2026, and regular certificate verification was disabled on Jan 16, 2026.
The vulnerability allowed attackers to insert a leaf certificate at any point in the certificate chain.
Why It Matters
If you're using Xray-core for secure communications, this flaw could have exposed your data to man-in-the-middle attacks. The fix on Feb 6, 2026, only partially addressed the issue, leaving systems vulnerable until the full fix was implemented. This highlights the importance of regular security audits and transparent communication from maintainers.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.