---
title: "CVE-2025-61778: Akka.Remote TLS did not properly implement certificate-based authentication"
url: https://erroneo.us/security/cve/CVE-2025-61778/
description: "CVE-2025-61778 (Akka.Remote (NuGet)): Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-10-06
date_modified: 2025-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-61778"
kev: false
cvss: 9.3
epss: 0.00308
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-61778: Akka.Remote TLS did not properly implement certificate-based authentication

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.3% , percentile 22: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 22% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes Akka.Remote (NuGet) >= 1.2.0, < 1.5.52, fixed in 1.5.52 ; Akka.Cluster (NuGet) >= 1.2.0, < 1.5.52, fixed in 1.5.52 . Check your lockfile, including transitive dependencies.

## What it is

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections. Akka.Remote, however, never asked the outbound-connecting client to present ITS certificate - therefore it's possible for untrusted parties to connect to a private key'd Akka.NET cluster and begin communicating with it without any certificate. The issue here is that for certificate-based authentication to work properly, ensuring that all members of the Akka.Remote network are secured with the same private key, Akka.Remote needed to implement mutual TLS. This was not the case before Akka.NET v1.5.52. Those who run Akka.NET inside a private network that they fully control or who were never using TLS in the first place are now affected by the bug. However, those who use TLS to secure their networks must upgrade to Akka.NET V1.5.52 or later. One patch forces "fail fast" semantics if TLS is enabled but the private key is missing or invalid. Previous versions would only check that once connection attempts occurred. The second patch, a critical fix, enforces mutual TLS (mTLS) by default, so both parties must be keyed using the same certificate. As a workaround, avoid exposing the application publicly to avoid the vulnerability having a practical impact on one's application. However, upgrading to version 1.5.52 is still recommended by the maintainers.

## Affected packages

- NuGet `Akka.Remote` >= 1.2.0, < 1.5.52 → fixed: 1.5.52
- NuGet `Akka.Cluster` >= 1.2.0, < 1.5.52 → fixed: 1.5.52

## Affected products (CVE record)

- akkadotnet akka.net: >= 1.2.0, < 1.5.52

## Severity

- GitHub_M CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.31% probability of exploitation activity in the next 30 days; percentile 22.

## Sources

- [GitHub Advisory GHSA-jhpv-4q4f-43g5](https://github.com/advisories/GHSA-jhpv-4q4f-43g5)
- [CVE.org record CVE-2025-61778](https://www.cve.org/CVERecord?id=CVE-2025-61778)
- [NVD entry CVE-2025-61778](https://nvd.nist.gov/vuln/detail/CVE-2025-61778)
- [github.com](https://github.com/akkadotnet/akka.net/security/advisories/GHSA-jhpv-4q4f-43g5)
- [github.com](https://github.com/akkadotnet/akka.net/pull/7847)
- [github.com](https://github.com/akkadotnet/akka.net/pull/7851)
- [getakka.net](https://getakka.net/articles/remoting/security.html)
- [github.com](https://github.com/akkadotnet/akka.net/releases/tag/1.5.52)

---
Source page: https://erroneo.us/security/cve/CVE-2025-61778/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt