LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients (CVE-2026-112816)
Original title: CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
CVSS 10.0 flaw in mutual TLS certificate validation lets attackers impersonate trusted clients without private key; fixed in LXD 6.10.1 and MicroCloud 3.4.1.
A critical flaw in Canonical's LXD and MicroCloud allows an attacker with network access to the HTTPS API and a trusted client's public certificate to impersonate that client via the TLS certificate chain. The server accepts the chain despite the client lacking the private key for the leaf certificate. If the impersonated account is privileged, the attacker gains root access. No public exploitation or CISA KEV listing. Fixed versions released for snaps.
Unconfirmed: No public sign the flaw has been used in an attack; CISA assessment dated October 30 states not known to have been exploited
- CVE-2026-112816 has CVSS 10.0
- Affected LXD versions 4.0.14, 5.0.10, 5.21.8, 6.9
- Fixed LXD: 4.0.15, 5.0.11, 5.21.9, 6.10.1
- Affected MicroCloud: before 3.4.1 and 2.1.5
- No known exploitation
- CVEs
- CVE-2026-112816
- Vendors
- Canonical
- Products
- LXDMicroCloud
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112816 | Improper certificate validation in Canonical LXD HTTPS listener | 10.0 | <1% | PoC |
From the original article
3 min read at thehackernews.com
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.