Critical Vulnerability in Canonical's LXD and MicroCloud Allows Unauthorized Access
A critical flaw in Canonical's LXD and MicroCloud lets attackers impersonate trusted clients without private keys. Canonical has issued patches, and no exploitation has been reported.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
A critical flaw allows attackers to impersonate trusted clients in LXD and MicroCloud.
A critical vulnerability identified as CVE-2026-112816 has been discovered in Canonical's LXD and MicroCloud products. This flaw allows attackers to log in as trusted clients without possessing their private keys.
The vulnerability, which has a maximum CVSS score of 10.0, affects the mutual TLS authentication used to secure the HTTPS API. Attackers can exploit this flaw by presenting a crafted certificate chain that includes a trusted client's public certificate.
To execute the attack, network access to the HTTPS API and possession of a trusted client's public certificate are required. However, there is no public evidence that this flaw has been exploited in the wild, according to a U.S. CISA assessment dated October 30.
Canonical has released fixed versions of LXD and MicroCloud to address this issue. The affected versions of LXD include 4.0.14, 5.0.10, 5.21.8, and 6.9, prior to the fixed releases. The Incus project, a community fork of LXD, reported the flaw and has also issued a fix in version 7.6.0.
