Source: The Hacker News
Canonical has fixed a maximum-severity vulnerability in LXD and MicroCloud that let an attacker log in as a trusted client without ever holding that client’s private key. The flaw, tracked as CVE-2026-112816, carries a CVSS v4.0 score of 10.0 and is classified as improper certificate validation.
How the attack worked
LXD and MicroCloud authenticate remote clients over mutual TLS, where a client proves its identity by presenting a certificate. The bug was in how the server checked the certificate chain. The TLS handshake only proves that the client owns the private key of the first certificate in the chain, but LXD compared every certificate in the client-supplied chain against its trust store. An attacker could therefore present their own leaf certificate and append the public certificate of a trusted client behind it, and the server would treat them as that trusted client.
To exploit the flaw, an attacker needed network access to the HTTPS API and the public certificate of a trusted client, which is not a secret. If the impersonated identity was privileged, the attacker could gain root access to the host machine and full control of the cluster and its virtual machines.
Who is affected
A standalone LXD install listens only on a local Unix socket by default and is not exposed unless an administrator enabled the network listener. LXD clusters and MicroCloud installations always run with the API exposed, and in MicroCloud an attacker who captured a joining cluster member’s public certificate could reuse it to authenticate as that member.
Canonical released fixed snaps on 29 October 2026: LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, plus MicroCloud 3.4.1 and 2.1.5. Because the fixed releases rolled out progressively, administrators should verify the running version after refreshing rather than assume the fix arrived. The community fork Incus carries the same flaw and fixed it in version 7.6.0. Canonical lists no workaround other than upgrading, and until systems are patched, restricting network reachability of the HTTPS listener is the main interim control. No exploitation has been observed so far.
What this means for your infrastructure
Self-hosted container and VM platforms are part of the production estate, and a 10.0-rated authentication bypass in the control plane deserves immediate attention even without active exploitation. If you run LXD or MicroCloud clusters in Europe, refreshing the snaps and confirming the exact running version should be on this week’s checklist.
Need help auditing your infrastructure or preparing for EU cloud rules? Contact the team at Excello Digital for professional advice and hands-on support.