Critical CVSS 10.0 Flaw Found in Canonical LXD and MicroCloud
A certificate validation error allows unauthorized attackers to impersonate trusted clients and gain host root access.
1Critical Authentication Bypass Vulnerability
A critical security flaw, tracked as CVE-2026-112816, affects Canonical's LXD and MicroCloud platforms. With a maximum CVSS score of 10.0, the vulnerability allows unauthorized attackers to impersonate trusted clients. By bypassing standard authentication, attackers can gain full root access to the underlying host machine if the impersonated account holds sufficient administrative privileges.
2Flawed Certificate Chain Validation
The root cause lies in how the server validates TLS certificates. The system incorrectly compared all certificates in a chain against the trust store. Attackers exploit this by attaching a trusted client's public certificate to their own certificate chain. The server mistakenly accepts this as proof of identity, despite the attacker lacking the private key.
3Attack Requirements and Vector
Exploiting this vulnerability requires two specific conditions: network access to the HTTPS API and possession of a trusted client's public certificate. While standalone LXD servers are typically secure by default, enabling the core.https_address setting exposes the API. MicroCloud clusters are particularly vulnerable, as attackers can capture certificates during the cluster joining process.
4Affected Versions and Remediation
Canonical identified multiple affected versions, including LXD 4.0.14, 5.0.10, 5.21.8, and 6.9. Users must update to the latest snap versions to mitigate the risk. Administrators should execute 'sudo snap refresh lxd' and 'sudo snap refresh microcloud'. Canonical advises verifying the version number post-update, as releases were rolling out from the candidate channel.
5Community Discovery and Fork Impact
The vulnerability was initially identified by the Incus project, a community fork of LXD. Incus confirmed the flaw and implemented a fix in version 7.6.0, which also addressed seventeen additional security issues. Canonical subsequently confirmed that the same underlying logic error affected their LXD and MicroCloud products, prompting the coordinated security advisory release.
6Current Threat Landscape Status
As of October 30, there is no evidence that this vulnerability has been exploited in the wild. The U.S. CISA has not included this CVE in its Known Exploited Vulnerabilities list. Furthermore, no functional exploit code has been publicly released, providing a critical window for administrators to patch their systems before potential attacks.
7Mitigation Without Immediate Patching
Canonical stated there is no temporary configuration workaround for LXD. Since the attack vector relies on network reachability, restricting access to the HTTPS API listener is the only viable interim defense. Incus developers similarly emphasized that network isolation is the sole method to reduce risk until the software is updated to the patched version.
8Security Infrastructure Implications
This incident highlights the risks associated with mutual TLS implementations in container management systems. Relying solely on public certificate presence without verifying private key ownership creates significant identity gaps. Organizations must prioritize robust identity visibility and continuous monitoring of API access points to prevent unauthorized cluster escalation and maintain overall host machine integrity.
Original article: The Hacker News — Critical CVSS 10.0 Flaw Found in Canonical LXD and MicroCloud