Critical LXD and MicroCloud flaw enables trusted-client impersonation - Cybersecurity

Canonical has fixed a CVSS 10.0 vulnerability that could let attackers impersonate trusted LXD or MicroCloud clients using a public certificate, potentially gaining access to clusters, virtual machines and, in privileged cases, the host system.

A critical vulnerability in Canonical’s LXD and MicroCloud platforms could allow an attacker to log in as a trusted client without possessing that client’s private key. Tracked as CVE-2026-112816, the flaw has a maximum CVSS score of 10.0.

Exploitation requires network access to the products’ HTTPS API and the public certificate of a client already trusted by the server. Once authenticated, the attacker could operate with the permissions of the impersonated client, including access to the cluster and its virtual machines. If that account had administrative privileges, Canonical said the attacker could obtain root access to the host machine.

The vulnerability affected the way LXD and MicroCloud validated certificates during mutual TLS authentication. Although the connection proves ownership of the private key associated with the first certificate in the chain, the server compared all certificates presented by the client with its trust store. An attacker could therefore place a trusted client’s publicly available certificate behind their own certificate and be accepted as that client.

A standalone LXD installation does not expose the vulnerable API by default. It normally listens on a local socket unless an administrator enables the network API through the core.https_address setting. In MicroCloud environments, Canonical identified an additional risk: an attacker able to capture a member’s public certificate while it joins the cluster could subsequently authenticate as that member.

The affected LXD versions listed in the CVE record include 4.0.14, 5.0.10, 5.21.8 and 6.9. Canonical has released fixes through the following snap channels: LXD 6.10.1 in 6/stable, 5.21.9 in 5.21/stable, 5.0.11 in 5.0/stable and 4.0.15 in 4.0/stable. Fixed MicroCloud releases are 3.4.1 in 3/stable and 2.1.5 in 2/stable.

The issue was reported by the Incus project, a community fork of LXD, and was confirmed to affect Canonical’s products. Incus addressed the same vulnerability in version 7.6.0. Ubuntu archive packages of LXD are listed as not affected or not shipped, leaving the snap releases as the relevant fixed versions.

There is currently no public indication that the vulnerability has been exploited. A CISA assessment dated October 30 states that exploitation is not known, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. No working exploit has been published.

Administrators using snap installations should update with sudo snap refresh lxd and sudo snap refresh microcloud, then verify the installed versions. Canonical noted that the fixed LXD point releases were still moving from the candidate channel to stable when its advisory was issued. Until updates are applied, restricting network access to the HTTPS API can reduce exposure; Canonical and Incus reported no configuration-based workaround. Incus users should update to version 7.6.0.

Sources: The Hacker News.