Critical Vulnerabilities in Incus and LXD Allow Full Cluster Access
Original title: Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access
Unauthenticated attackers can impersonate trusted certificates to gain full access to Incus and LXD clusters without credentials.
Certificate-validation flaws in Incus and Canonical LXD let attackers append trusted public certificates to their own chains during TLS handshake, bypassing authentication checks. The Incus issue (GHSA-xg75-xf37-cph9) affects all releases prior to 7.6.0 and has CVSS 10.0. LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9 are vulnerable with fixes in 4.0.15, 5.0.11, 5.21.9, and 6.10.1. Exploitation requires only network access to the HTTPS listener; no private key or credentials are needed.
- Attacker appends target server certificate to impersonate trusted identities
- Affects Incus prior to 7.6.0 and specific LXD versions listed above
- Also impacts host-to-VM agent authentication and authorization scriptlets
- No configuration workaround exists; restrict HTTPS access to trusted hosts
Impact: Unauthenticated cluster takeover via certificate-chain impersonation
- 1.Upgrade to Incus 7.6.0 or patched LXD releases
- 2.Restrict HTTPS management access to trusted hosts
- 3.Monitor for unexpected certificate usage
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112816 | Improper certificate validation in Canonical LXD HTTPS listener | 10.0 | <1% | PoC ×2 |
From the original article
2 min read at gbhackers.com
Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requires network access to the HTTPS listener but does not require valid credentials or the private key for a trusted certificate.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.