conv.

All stories
SecurityQuiet 9d · day 12

Canonical patches CVSS 10.0 LXD flaw allowing trusted client impersonation

A critical certificate validation bug in LXD and MicroCloud lets attackers impersonate trusted clients without private keys.

newest coverage 9d agosummary written 9d ago6 pieces14 likes & upvotes1 comments XGoogle NewsMastodon

What to know

  • CVE-2026-112816 is a CVSS 10.0 vulnerability in LXD and MicroCloud allowing attackers to impersonate trusted clients by exploiting certificate chain validation.
  • Exploitation requires network access to the HTTPS API and possession of a trusted client's public certificate—not a private key.
  • Successful impersonation grants full cluster access and potentially root access to host machines; patches are available for snap-based installations.
  • No known exploitation in the wild as of October 30; temporary mitigation is to restrict network access to the API until patched.

“Because the attack requires network access to the API, limiting who can reach it reduces risk until you update.”

Canonical, Vendor mitigation guidance · The Hacker News ↗

Canonical Software vendorIncus project Community fork maintainerCISA U.S. cybersecurity authority

Canonical patches CVSS 10.0 LXD flaw allowing trusted client impersonation
thehackernews.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 3 pieces in 3h at Nov 1, 2 AM; 6 pieces over 12 days (4 articles · 2 posts) Oct 30, 12 PM — 1 piece · 1 post — X 1Oct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — 3 pieces · 3 articles — Google News 3Nov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — 1 piece · 1 post — Mastodon 1Nov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — 1 piece · 1 article — Mastodon 1Nov 2, 5 PM — quietNov 2, 8 PM — quietNov 2, 11 PM — quietNov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — quietNov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quiet 12
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 5:49 AM ET
  1. 2

    Canonical releases fixed versions of LXD and MicroCloud

    Canonical publishes detailed advisory on the vulnerability, explaining the root cause: the server validates all certificates in a client's chain against the trust store, but only the leaf certificate's private key ownership is cryptographically proven. An attacker can attach a trusted client's public certificate to their own certificate chain to gain impersonation. Fixed snap versions are released for LXD 4.0.15, 5.0.11, 5.21.9, and 6.10.

    “A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key.”
    — The Hacker News, Security news outlet · source
    1. 3 outlets Canonical LXD and MicroCloud CVE-2026-112816: Certificate Chain Flaw Lets Attackers Pose as Trusted Clients (CVSS 10.0)

      first by Rescana, 10d ago · also The 420.in, The Hacker News

      2 more headlines
  2. 1 day quiet
  3. 1

    CVE database flags impersonation vulnerability at maximum severity

    The CVE advisory for CVE-2026-112816 is published, rating the flaw CVSS 10.0 and noting that an unauthenticated attacker can impersonate a trusted client to take full control of clusters and VMs.

    “An unauthenticated attacker can impersonate a trusted client to take full control of the cluster and its VMs.”
    — @cvedotnow

    • 🔴 Canonical LXD: client impersonation via certificate flaw in HTTPS listener (CVE-2026-112816) An unauthenticated attacker can impersonate a trusted client to take full control of the cluster and its VMs. Patch → 4.0.15, 5.0.11 and more

      @cvedotnowX11d ago9▲view on X ↗
  4. background

    Incus project reports certificate validation flaw in LXD — The Incus project discovered and reported CVE-2026-112816, a critical flaw in certificate chain validation affecting LXD's HTTPS API authentication. Canonical confirmed the same vulnerability affected LXD and released patches.