Canonical has patched CVE-2026-112816, a CVSS 10.0 authentication flaw in LXD and MicroCloud. It lets an attacker log in as a trusted client without holding that client's private key. The Hacker News reported the details on November 1, citing Canonical's advisory and the CVE record.
LXD and MicroCloud use mutual TLS on their HTTPS APIs. A client is trusted if its certificate is in the server's trust store. The server checked every certificate the client sent against that store. A TLS handshake only proves possession of the private key for the leaf certificate, and the server did not limit trust to the leaf.
The certificates after the leaf are whatever the client attaches. An attacker can append a trusted client's public certificate, which is not secret, behind their own chain. The server then accepts them as that client. If the impersonated client is privileged, Canonical says the attacker could gain root access to the host machine.
Conditions for an attack: network access to the HTTPS API, and the public certificate of a client the server already trusts. Standalone LXD does not expose the API by default. It listens on a local socket unless an administrator sets core.https_address. In MicroCloud, an attacker who captures a member's public certificate as it joins the cluster can log in as that member.
Affected releases are listed in the CVE record as LXD 4.0.14, 5.0.10, 5.21.8 and 6.9, each before the fix. Ubuntu's archive packages are listed as not affected. The affected builds are the snaps. The Incus project reported the bug (GHSA-xg75-xf37-cph9), and Canonical then confirmed LXD is also affected.
Fixed versions per Canonical: LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5. The Incus fork fixed it in 7.6.0, which also closes 17 other security issues.
There is no public evidence of exploitation. A CISA assessment dated October 30, recorded in the CVE, says the flaw is not known to be exploited. It is not on the KEV list, and no working exploit has been published.
Mitigation. Update with sudo snap refresh lxd and sudo snap refresh microcloud, then verify the installed version. Canonical noted some fixed LXD point releases were still moving from the candidate channel to stable when the advisory was issued. Canonical offers no workaround for LXD. Until you patch, restrict who can reach the HTTPS API. Incus has no configuration fix either, so restrict network access to its listener and upgrade to 7.6.0.
Blue teams should inventory any LXD or MicroCloud host that sets core.https_address, check whether the listener is reachable beyond the management network, and review trust-store entries for clients that should no longer be trusted.
