Critical Vulnerabilities in Incus and LXD Allow Full Cluster Access
Unauthenticated attackers can impersonate trusted certificates to gain full access to Incus and LXD clusters without credentials.
Stories per day · 30 days
2 RSS
Relatedcanonical2impersonation2lxd2authorization-bypass1boringssl1ca1cert-cc1compromise1consul1emsign1google1hashicorp1incus1microcloud1mitm1name-constraints1openvpn1pip1
10 stories, newest first · one card per story
Stories tagged #certificate
LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients (CVE-2026-112816)
CVSS 10.0 flaw in mutual TLS certificate validation lets attackers impersonate trusted clients without private key; fixed in LXD 6.10.1 and MicroCloud 3.4.1.
1
HashiCorp Consul auth bypass in service mesh leaf certificate API
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
virtualenv 21.14.11 noted for Python users after emSign CA incident
The release vendors pip and requires python-discovery 1.6.1 or newer.
eMudhra Intermediate CA Private Keys Compromised
Eight eMudhra intermediate CA private keys generated with insufficient randomness were compromised, enabling private key derivation and unauthorized TLS certificate signing.
2
OpenVPN certificate subject handling flaw may allow impersonation
Ubuntu says a remote authenticated user could possibly impersonate other users; no CVE or versions are given.
VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
CERT/CC reports five BoringSSL Name Constraints flaws, with two fixed and three unresolved or rejected.
Leaky TLS Certificate Exposes North Korea’s Hangro VPN Infrastructure Across Two Countries
North Korea's Hangro VPN exposed detailed infrastructure across North Korea and Russia via TLS certificates.
3
Re: Retrospective by 'gpg.fail' authors
Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.
2