cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Critical LXD and MicroCloud Flaw Enables Trusted-Client Impersonation

· Original article ↗

Summary

CVE-2026-112816 lets an attacker with API network access and a trusted client's public certificate impersonate that client in LXD or MicroCloud. Canonical released fixes; no public exploitation is known.

Key points

  • The CVSS 10.0 flaw affected LXD and MicroCloud mutual TLS authentication, allowing impersonation without the trusted client's private key.
  • Exploitation requires network access to the HTTPS API and the public certificate of a trusted client.
  • An impersonated client can access the cluster and its virtual machines; a privileged client may enable root access to the host.
  • Canonical listed LXD 4.0.14, 5.0.10, 5.21.8, and 6.9 as affected before their respective fixed releases.
  • Canonical released fixes for LXD and MicroCloud; administrators should update and verify the installed version. Fixed LXD snap releases were still rolling out to stable when the advisory was issued.
  • For LXD, restricting access to the network API reduces exposure until updating; the article says no temporary configuration workaround is available.
  • The CVE record's October 30 CISA assessment said exploitation was not known; no working exploit had been published.

Article Details

Vulnerability Types
  • Mutual TLS client-certificate validation flaw enabling trusted-client impersonation without possession of the client's private key
Severity
Critical (CVSS 10.0)
Affected Versions
  • LXD 4.0.14
  • LXD 5.0.10
  • LXD 5.21.8
  • LXD 6.9
Exploitation Status
not_reported
Exploit Availability
none_reported
Patch Status
available
Workarounds
  • Restrict network access to the HTTPS API listener until the update is applied.

CVE

CVE-2026-112816The flaw, tracked as CVE-2026-112816, carries a maximum CVSS score of 10.0, and Canonical has released fixed versions of both products.

Vendors

CanonicalA critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the

Products

IncusThe bug did not start at Canonical. The Incus project, which began as a community fork of LXD, reported it, and Canonical confirmed it affected LXD as well. Incus fixed the same flaw in version 7.6.0.LXDA critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have theMicroCloudA critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the