LXD flaw lets attackers impersonate trusted TLS clients

Canonical has patched CVE-2026-112816, a critical mutual TLS authentication flaw in LXD and MicroCloud, rated 10.0 under CVSSv4. Canonical says an attacker able to reach the LXD HTTPS API could authenticate as a trusted TLS client if they possess that client’s public certificate. The vulnerability affects LXD 4.0.14, 5.0.10, 5.21.8 and versions 6.9 through 6.10.0; MicroCloud 2.x and 3.x also require updates.

The flaw lies in certificate-chain validation: LXD compared certificates supplied by a client with entries in its trust store, although only the leaf certificate proves possession of the signing key. An attacker could therefore present a trusted user’s public certificate as an intermediate and be accepted. In MicroCloud, an attacker could also intercept a joining member’s public certificate and impersonate that member.

Depending on the victim’s permissions, an attacker could gain full access to a cluster and its managed virtual machines, potentially reaching root-level access on the host. The issue was first reported by the Incus project and confirmed by Canonical. No exploitation had been reported.

Canonical released fixes on 29 October: LXD 4.0.15, 5.0.11, 5.21.9 or 6.10.1, and MicroCloud 2.1.5 or 3.4.1. Canonical says the point releases are being rolled out progressively from candidate to stable; the recommended update command is `snap refresh` for both packages.