Overview
A critical flaw, CVE-2026-112816 (CVSS 10.0), in Canonical's LXD and MicroCloud lets an attacker authenticate as a trusted client without holding that client's private key. The attacker must reach the HTTPS API over the network and have the trusted client's public certificate. Once in, they act with that client's permissions.
The Incus project reported the issue (GHSA-xg75-xf37-cph9), and Canonical confirmed LXD was also affected.
How It Works
The server checked each certificate in the client's chain against its trust store. But mutual TLS only proves possession of the leaf certificate's private key. An attacker could present their own leaf and attach a trusted client's public certificate behind it in the chain, and be accepted as that trusted client.
Preconditions:
- Network access to the LXD/MicroCloud HTTPS API
- The public certificate of a client the server already trusts
A standalone LXD server does not expose the API by default. For MicroCloud, capturing a member's public certificate as it joins the cluster is a specific risk.
Affected and Fixed Versions
Affected releases include LXD 4.0.14, 5.0.10, 5.21.8, and 6.9.
| Product | Snap channel | Fixed version |
|---|---|---|
| LXD | 6/stable | 6.10.1 |
| LXD | 5.21/stable | 5.21.9 |
| LXD | 5.0/stable | 5.0.11 |
| LXD | 4.0/stable | 4.0.15 |
| MicroCloud | 3/stable | 3.4.1 |
| MicroCloud | 2/stable | 2.1.5 |
Incus fixed the same flaw in 7.6.0. Ubuntu's archive packages of LXD are listed as not affected or not shipped.
Exploitation Status
No known exploitation. The CVE record carries a CISA assessment dated October 30 that the flaw is not known to be exploited. It is not on the KEV list and no working exploit has been published.
Recommendations
- Update:
sudo snap refresh lxdandsudo snap refresh microcloud, then verify the version you actually run; fixed point releases were still rolling from candidate to stable. - Canonical offers no workaround for LXD, but restricting who can reach the API reduces risk until you update. Incus recommends the same, then moving to 7.6.0.
- Limit the API listener to management networks and review the list of trusted client certificates.
- Review LXD/MicroCloud logs for unexpected client activity from unfamiliar addresses.