What is CVE-2025-61778?

CVE-2025-61778 is a critical-severity security vulnerability in Akka.Remote (nuget), affecting versions >= 1.2.0, < 1.5.52. It is fixed in 1.5.52.

Which packages are affected by CVE-2025-61778?

Akka.Remote (nuget) versions >= 1.2.0, = 1.2.0, < 1.5.52.

Is there a fix for CVE-2025-61778?

Yes. CVE-2025-61778 is fixed in 1.5.52. Upgrade to this version or later.

Is CVE-2025-61778 exploitable, and should I be worried?

Whether CVE-2025-61778 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2025-61778 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2025-61778?

Upgrade: Akka.Remote to 1.5.52 or later, Akka.Cluster to 1.5.52 or later.

CVE-2025-61778 in Akka.Remote

Q: Which packages are affected by CVE-2025-61778?

Akka.Remote (nuget) versions >= 1.2.0, = 1.2.0, < 1.5.52.

Q: Is there a fix for CVE-2025-61778?

Yes. CVE-2025-61778 is fixed in 1.5.52. Upgrade to this version or later.

Q: Is CVE-2025-61778 exploitable, and should I be worried?

Whether CVE-2025-61778 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2025-61778 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2025-61778?

Upgrade: Akka.Remote to 1.5.52 or later, Akka.Cluster to 1.5.52 or later.

Summary

Akka.Remote TLS did not properly implement certificate-based authentication

Workarounds

If your application isn't exposed publicly, then CVE-2025-61778 has no practical impact on your application. That being said: upgrading to Akka.NET v1.5.52 or later is a good idea.

References

Please view our latest network security documentation here: https://getakka.net/articles/remoting/security.html

Impact

This is a critical network security vulnerability for Akka.Remote users who have SSL / TLS enabled on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network.

In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections. Akka.Remote, however, never asked the outbound-connecting client to present ITS certificate - therefore it's possible for untrusted parties to connect to a private key'd Akka.NET cluster and begin communicating with it without any certificate.

The issue here is that for certificate-based authentication to work properly, ensuring that all members of the Akka.Remote network are secured with the same private key, Akka.Remote needed to implement mutual TLS. This was not the case before Akka.NET v1.5.52.

If you are running Akka.NET inside a private network you fully control or you were never using TLS in the first place, then this bug has no impact on you. However: if you are using TLS to secure your network YOU MUST upgrade to Akka.NET V1.5.52 or later.

Affected versions

Akka.Remote (>= 1.2.0, < 1.5.52) Akka.Cluster (>= 1.2.0, < 1.5.52)

Security releases

Akka.Remote → 1.5.52 (nuget) Akka.Cluster → 1.5.52 (nuget)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

https://github.com/akkadotnet/akka.net/pull/7847 - forces "fail fast" semantics if TLS is enabled but the private key is missing or invalid. Previous versions would only check that once connection attempts occurred.
https://github.com/akkadotnet/akka.net/pull/7851 - critical fix: enforces mutual TLS (mTLS) by default, so both parties must be keyed using the same certificate. This fulfills the original security

These updates have been shipped into Akka.NET v1.5.52: https://github.com/akkadotnet/akka.net/releases/tag/1.5.52

Frequently Asked Questions

What is CVE-2025-61778? CVE-2025-61778 is a critical-severity security vulnerability in Akka.Remote (nuget), affecting versions >= 1.2.0, < 1.5.52. It is fixed in 1.5.52.
Which packages are affected by CVE-2025-61778?
- Akka.Remote (nuget) (versions >= 1.2.0, < 1.5.52)
- Akka.Cluster (nuget) (versions >= 1.2.0, < 1.5.52)
Is there a fix for CVE-2025-61778? Yes. CVE-2025-61778 is fixed in 1.5.52. Upgrade to this version or later.
Is CVE-2025-61778 exploitable, and should I be worried? Whether CVE-2025-61778 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2025-61778 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2025-61778?
- Upgrade Akka.Remote to 1.5.52 or later
- Upgrade Akka.Cluster to 1.5.52 or later