Certificate Validation Flaw in LXD and Incus Allows Unauthenticated Host Control
Original title: Critical 10.0-Rated Certificate Validation Flaw in LXD and Incus Could Give Hackers Control of Linux Hosts
The flaw lets attackers impersonate trusted certificates during TLS handshakes to bypass authentication in LXD and Incus clusters.
Incus and LXD disclose a critical certificate validation flaw in their HTTPS management listeners. The weakness has existed since project initial release. An attacker can append a server's public certificate to their chain and gain access without a password or private key. Incus rates the issue critical with a CVSS score of 10.0. Canonical published CVE-2026-112816 on October 30.
Unconfirmed: No active exploitation reported in the advisories
- Affects Incus versions before 7.6.0
- LXD fixed in branches 4.0.15, 5.0.11, 5.21.9 and 6.10.1
- No active exploitation reported
- Public certificates are sufficient for access
- Authorization scriptlet and agent connections also impacted
Impact: unauthenticated cluster and VM control
| Product | Affected | Fixed in |
|---|---|---|
| Incus | before 7.6.0 | 7.6.0 |
| Canonical LXD | before 4.0.15, 5.0.11, 5.21.9, 6.10.1 | 4.0.15, 5.0.11, 5.21.9, 6.10.1 |
- 1.Upgrade to Incus 7.6.0 or affected LXD patched branches
- 2.Restrict HTTPS listener access to trusted hosts only
- CVEs
- CVE-2026-112816
- Products
- LXD
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112816 | Improper certificate validation in Canonical LXD HTTPS listener | 10.0 | <1% | PoC ×2 |
From the original article
3 min read at cybersecuritynews.com
A critical certificate validation flaw in LXD and Incus could let remote attackers bypass login checks and take control of clusters and managed virtual machines. The weakness affects the HTTPS management listener, placing exposed Linux systems at risk without requiring a password, stolen private key, or user interaction. Incus rates its flaw critical, with a […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.