Critical Akka.NET Flaw CVE-2025-61778 (CVSS 9.3) Allows Untrusted Nodes to Join Secure Clusters

The Akka[.]NET team has issued a critical advisory for a vulnerability in its Akka[.]Remote module, CVE-2025-61778, rated CVSSv4 9.3 (Critical). The flaw could allow untrusted systems to join or communicate with trusted clusters without proper certificate validation, affecting all versions from v1.2.0 through v1.5.51 and fixed in Akka[.]NET v1.5.52.

According to the advisory, Akka[.]Remote TLS did not properly implement certificate-based authentication, because outbound clients were not required to present their certificates, effectively bypassing mutual authentication. The issue means an attacker could impersonate a legitimate node and exchange messages within a TLS-protected cluster.

The maintainers released two patches: one to fail fast when the private key is missing or invalid, and another to enforce mutual TLS by default, with both client and server required to present certificates during the handshake, now included in Akka[.]NET v1.5.52, which has nearly 19 million downloads.