Canonical has fixed a maximum-severity (CVSS 10.0) flaw in LXD and MicroCloud, tracked as CVE-2026-112816, that let an attacker authenticate as any trusted client without that client’s private key. The attacker needs network access to the HTTPS API and the trusted client’s public certificate, which is not secret. Canonical says that, depending on the privileges of the impersonated user, the attacker could gain root access to the host.
The bug is in how the server checks mutual TLS. LXD compared every certificate in the chain a client sent against its trust store, but a TLS connection only proves the client holds the private key for the first (leaf) certificate; the rest of the chain is whatever the client attaches. So an attacker could present their own certificate with a trusted client’s public certificate tucked behind it as an intermediate, and the server would accept them as that client. In MicroCloud, Canonical says an attacker who intercepts the public certificate of a member that is joining a cluster can then log in as that member.
The flaw was reported to Canonical by the Incus project, a community fork of LXD, which confirmed it also affected LXD. According to The Hacker News, the CVE record carries a U.S. CISA assessment dated October 30 that the flaw is not known to have been exploited, it is not on CISA’s Known Exploited Vulnerabilities list, and no working exploit has been published. Canonical’s advisory was posted on October 28 and the fixed snaps are dated October 29.
How to check if you’re affected
Affected products are Canonical’s LXD and MicroCloud. Per The Hacker News, a standalone LXD server does not expose the network API by default; it listens only on a local socket unless an administrator enables the network API with the core.https_address setting. MicroCloud clusters have the extra weak point of the join step described above. The CVE record lists LXD 4.0.14, 5.0.10, 5.21.8 and 6.9 as affected, each before the fixed release that follows, and Ubuntu’s archive packages of LXD are described as not affected or not shipped, so the fixed releases are snaps.
Canonical’s fixed snap versions:
| Product | Snap channel | Fixed version |
|---|---|---|
| LXD | 6/stable | 6.10.1 |
| LXD | 5.21/stable | 5.21.9 |
| LXD | 5.0/stable | 5.0.11 |
| LXD | 4.0/stable | 4.0.15 |
| MicroCloud | 3/stable | 3.4.1 |
| MicroCloud | 2/stable | 2.1.5 |
Update with sudo snap refresh lxd and sudo snap refresh microcloud. Canonical notes the LXD point releases were still rolling out from the candidate channel to stable, so check the version you actually have after refreshing instead of assuming the fix arrived. Canonical gives no temporary workaround for LXD; The Hacker News notes that limiting who can reach the API reduces risk until you update. The Incus project says there is no configuration fix and the only step is to restrict network access to the listener; Incus users should move to version 7.6.0, which fixed this flaw.
Sources
- Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud, Ubuntu Discourse
- CVE-2026-112816, Ubuntu security
- Authentication and authorization bypass through unverified client certificate chains, Incus advisory on GitHub
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key, The Hacker News