Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycritical

CVE-2026-112816 Lets LXD Attackers Impersonate Clients

2 sources · 2 articlesFirst reported Updated ()1
What's new

November 1: Report adds MicroCloud 3.4.1 fix and impersonation without private key.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Canonical fixes CVE-2026-112816 in LXD and MicroCloud that lets attackers impersonate trusted clients via public certificate chains without private keys, CVSS 10.0.

Canonical disclosed CVE-2026-112816, a critical flaw in LXD's HTTPS listener for mutual TLS certificate validation. An unauthenticated attacker with network access and a trusted client's public certificate can impersonate the client and gain full cluster access if privileged. This affects LXD versions 4.0.14, 5.0.10, 5.21.8 and 6.9. MicroCloud is also impacted before 3.4.1. No public exploitation is known. Patches were released for LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1.

Key facts
  • CVE-2026-112816 CVSS 10.0
  • LXD fixed: 4.0.15, 5.0.11, 5.21.9, 6.10.1
  • MicroCloud fixed: 3.4.1
  • Attacker needs only public cert, no private key
  • Published October 30, 2026 by Canonical
  • No known exploitation
Analyze CVE-2026-112816 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 30, 2026Canonical publishes CVE-2026-112816 record · Hacker News
  2. Nov 1, 2026Details MicroCloud affected versions and attack method · The Hacker News

What each outlet adds

beyond the shared facts
  • Hacker NewsLXD certificate validation and affected versions
  • The Hacker NewsMicroCloud 3.4.1 and impersonation without private key
CVEs
CVE-2026-112816
Vendors
Canonical
Products
LXDMicroCloud

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Hacker News · securityFirst report

    LXD HTTPS listener flaw lets attackers impersonate trusted clients

    CVSS 4.0 score is 10.0; fixed releases are 4.0.15, 5.0.11, 5.21.9, and 6.10.1.

  2. · 10h ago The Hacker News

    LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients (CVE-2026-112816)

    CVSS 10.0 flaw in mutual TLS certificate validation lets attackers impersonate trusted clients without private key; fixed in LXD 6.10.1 and MicroCloud 3.4.1.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-112816
Improper certificate validation in Canonical LXD HTTPS listener
10.0<1%PoC