CVE-2026-11281610.0Critical
Improper certificate validation in the HTTPS listener in LXD
Canonical · LXD
Not in CISA KEVFixed in version 4.0.15
0.3%probability of exploitation in the next 30 days
23rd percentile
050100
Higher than 23% of scored CVEs
10.0CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Coverage1 article · 1 outlet
First in our coverage: The Hacker News, 1 Nov.
- Canonical fixes critical LXD flaw that enables client impersonationThe Hacker News · first in our coverage
New articles also arrive in the RSS feed.