LXD HTTPS listener flaw lets attackers impersonate trusted clients
Original title: CVE 10.0: CVE-2026-112816, no emudhra required
CVSS 4.0 score is 10.0; fixed releases are 4.0.15, 5.0.11, 5.21.9, and 6.10.1.
Canonical published CVE-2026-112816 for improper certificate validation in the HTTPS listener of LXD. An unauthenticated attacker can use a crafted certificate chain to authenticate as any trusted client and gain full access to the cluster and managed virtual machines. Affected ranges are 4.0.14 before 4.0.15, 5.0.10 before 5.0.11, 5.21.8 before 5.21.9, and 6.9 before 6.10.1. The record was published on October 30 by Canonical Ltd.; exploitation is not discussed.
Unconfirmed: The CVE record does not say whether the flaw is exploited or whether a public exploit exists.
- CWE-295 covers the improper certificate validation.
- The vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N with high impact.
- Reporter credited in the record is Stéphane Graber.
- Ubuntu Discourse posts list the LTS releases that contain the fix.
Impact: Unauthenticated full access to the LXD cluster and VMs
| Product | Affected | Fixed in |
|---|---|---|
| Canonical LXD | 4.0.14 before 4.0.15; 5.0.10 before 5.0.11; 5.21.8 before 5.21.9; 6.9 before 6.10.1 | 4.0.15, 5.0.11, 5.21.9, 6.10.1 |
- 1.Upgrade LXD to 4.0.15, 5.0.11, 5.21.9, or 6.10.1 for the affected line.
- CVEs
- CVE-2026-112816
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112816 | Improper certificate validation in Canonical LXD HTTPS listener | 10.0 | — |
From the original article
2 min read at cve.orgOpens in a new window Opens an external website Opens an external website in a new window This website utilizes technologies such as cookies to enable essential site functionality, as well as for analytics, personalization, and targeted advertising. Privacy Policy [Overview](https://www. cve.
By paaloeye · cve.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.