Canonical Patches Maximum-Severity Flaw in LXD and MicroCloud
Canonical has fixed CVE-2026-112816, a 10.0-rated certificate flaw in LXD and MicroCloud that lets attackers impersonate trusted clients without a private key.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesCanonical announced on October 28 that it has fixed CVE-2026-112816, a vulnerability in the LXD container and virtual machine manager and the MicroCloud private cloud platform. The CodeScoring knowledge base rates it critical, with the maximum 10.0 score under CVSS 4.0. The flaw lets an attacker impersonate a trusted client without holding its private key.
How the attack works
The bug sits in the validation of client certificate chains. During a TLS handshake, the client proves possession of the private key only for the first certificate in the chain. The server, however, compared every certificate in the chain against its store of trusted clients. An attacker could therefore present their own certificate first, append the public certificate of a trusted client, and inherit that client's permissions.
To exploit it, an attacker needs access to the management HTTPS API and the target client's public certificate. MicroCloud has an additional scenario: an attacker could intercept a node's public certificate while it joins a cluster and then pose as that node.
The Incus project, an open fork of LXD, reported the problem to Canonical. A server's own certificate can be obtained during a TLS connection, and adding it to a chain gives access to the database gateway. Another node's certificate grants internal cluster access. Incus fixed the issue in version 7.6.0, and earlier versions are vulnerable. According to CodeScoring, the bug has existed in Incus since its first release, and the same bypass allowed renewing or deleting other entries in the trusted certificate store.
What administrators should do
By default, LXD listens only on a local Unix socket and accepts no network connections. Network access is enabled through the core.https_address setting, so the first step is to check whether the management interface is reachable from an untrusted network.
Fixed snap builds are dated October 29. For LXD they are 6.10.1, 5.21.9, 5.0.11 and 4.0.15; for MicroCloud, 3.4.1 and 2.1.5. Canonical recommends running sudo snap refresh lxd and sudo snap refresh microcloud. Because the rollout is staged, administrators should confirm the installed version against the list for their channel.
Until patching is complete, API access should be limited to trusted hosts. Incus developers state that no configuration option removes the flaw without updating. LXD, MicroCloud and Incus should also be included in the inventory of infrastructure software on hosts that run containers and virtual machines.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
More in: Security
See all →
Apple to Check Shared iCloud Links for Harmful Content in iOS 27.3
Crédit Mutuel Arkéa confirms cyberattack as fraud total unclear
South Korea to Add Cybersecurity to Top-Tier Hospital Ratings
