LXD Vulnerability CVE-2026-112816 (CVSS 10) Lets Attackers Impersonate Trusted Clients
Do Son 
TL;DR
Canonical has patched CVE-2026-112816, a critical LXD vulnerability with the maximum CVSS score of 10. The flaw also hits MicroCloud. According to Canonical, it lets an attacker who can reach the LXD HTTPS API “authenticate as any trusted TLS client, for which the attacker has the public certificate.”
A certificate-chain check bug lets attackers impersonate trusted users with only a public certificate. Depending on the victim’s rights, that can mean root on the host. Canonical released fixed snaps on October 29, so update now.
- CVE: CVE-2026-112816
- CVSS: 10.0 (Critical · CVSSv4)
- Product: Canonical LXD
- Affected: 4.0.14, 5.0.10, 5.21.8, 6.9.0
- Impact: Improper certificate validation in the HTTPS listener in LXD
- Status: No confirmed exploitation yet
- Patched in: 4.0.15, 5.0.11, 5.21.9, 6.10.1
- EPSS: 0.3% (30-day)
- Action: Update to 4.0.15, 5.0.11, 5.21.9, 6.10.1 now
Why It Matters
This LXD vulnerability matters because LXD and MicroCloud manage containers, virtual machines and clusters. Canonical’s CVE record says an attacker can “gain full access to the cluster and managed virtual machines.” Notably, public certificates are not secret, so the bar for attack is low.
How the Attack Works
LXD’s mutual TLS check “compared all peer certificates sent by the client to known trust store entries.” However, Canonical notes that “only the leaf certificate proves ownership of the signing key.” As a result, an attacker can add a trusted user’s public certificate as an intermediate. The flawed check then accepts the chain.
In MicroCloud, an attacker could also intercept a joining member’s public certificate and then pose as that member. The Incus project first reported the issue, and Canonical confirmed that LXD shared it.
Affected Versions
Canonical’s CVE record lists LXD 4.0.14, 5.0.10, 5.21.8 and 6.9 through 6.10.0 as affected. MicroCloud 2.x and 3.x also need updates.
Patch and Mitigation
Update to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15, and to MicroCloud 2.1.5 or 3.4.1. Run “snap refresh” for both packages. Canonical says the point releases are “in progressive roll out from candidate to stable.” So far, no exploitation has been reported, and the flaw is not in CISA’s KEV catalog.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
