conv.

← The whole story
Security
Canonical patches CVSS 10.0 LXD flaw allowing trusted client impersonation

Canonical releases fixed versions of LXD and MicroCloud

2 Nov 1 3:51 AM · 10d ago · 1 article · 2 posts · 2 sources · development 2 of 2

Canonical publishes detailed advisory on the vulnerability, explaining the root cause: the server validates all certificates in a client's chain against the trust store, but only the leaf certificate's private key ownership is cryptographically proven. An attacker can attach a trusted client's public certificate to their own certificate chain to gain impersonation. Fixed snap versions are released for LXD 4.0.15, 5.0.11, 5.21.9, and 6.10.

Canonical releases fixed versions of LXD and MicroCloud
thehackernews.com

“A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key.”

The Hacker News, Security news outlet · mastodon ↗

Canonical Software vendorIncus project Community fork maintainerCISA U.S. cybersecurity authority

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 3 pieces in 3h at Nov 1, 2 AM; 6 pieces over 12 days (4 articles · 2 posts) Oct 30, 12 PM — 1 piece · 1 post — X 1Oct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — 3 pieces · 3 articles — Google News 3Nov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — 1 piece · 1 post — Mastodon 1Nov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — 1 piece · 1 article — Mastodon 1Nov 2, 5 PM — quietNov 2, 8 PM — quietNov 2, 11 PM — quietNov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — quietNov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quietToday, 5 AM — quietToday, 8 AM — quietToday, 11 AM — quietToday, 2 PM — quietToday, 5 PM — quietToday, 8 PM — quiet 12
1CVE database flags impersonation…2Canonical releases fixed versions of LXD…
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 10:30 PM ET

What was reported 1 claim about this development

  1. 3 outlets Canonical LXD and MicroCloud CVE-2026-112816: Certificate Chain Flaw Lets Attackers Pose as Trusted Clients (CVSS 10.0)

    first by Rescana, 10d ago · also The 420.in, The Hacker News

    2 more headlines

All 2 developments of Canonical patches CVSS 10.0 LXD flaw allowing trusted… →

XGoogle NewsMastodon