Canonical fixes critical LXD flaw that enables client impersonation

A critical flaw in Canonical’s LXD and MicroCloud products could allow an attacker to log in as a trusted client without possessing that client’s private key. The vulnerability, tracked as CVE-2026-112816 and rated up to CVSS 10.0, would let a remote attacker use a trusted public certificate to authenticate over the mutual-TLS API, effectively granting access to the cluster and its virtual machines.

Canonical notes that, if the impersonated account is privileged, the attacker could obtain root access to the host machine. There are currently no public reports of exploitation, and a U.S. CISA assessment indicates there is no evidence of active exploitation.

Affected versions include LXD 4.0.14, 5.0.10, 5.21.8 and 6.9, with fixes delivered via snap updates. Canonical lists the fixed snap versions as: LXD 6.10.1 (6/stable), LXD 5.21.9 (5.21/stable), LXD 5.0.11 (5.0/stable) and LXD 4.0.15 (4.0/stable). For MicroCloud, fixed versions are MicroCloud 3.4.1 (3/stable) and MicroCloud 2.1.5 (2/stable).

The vulnerability arises from how the server validates client certificates in mutual TLS: the server compares the entire certificate chain against the trust store, but a TLS connection only proves ownership of the leaf certificate’s private key, allowing an attacker to attach a trusted public certificate to a chain behind their own certificate.

Standalone LXD servers typically listen on a local socket and require network access to the API, while MicroCloud introduces a cluster-wide risk if a member’s public certificate is captured during join. Administrators should upgrade to the fixed releases and, where possible, limit network exposure to the API until patches are applied. Canonical and the Incus project both acknowledge the flaw and publish the corresponding fixes.