CVE-2026-112816

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.14 through 4.0.14 Canonical LXD versions 5.0.10 through 5.0.10 Canonical LXD versions 5.21.8 through 5.21.8 Canonical LXD versions 6.9 through 6.9 Canonical MicroCloud (affected versions not specified)

Description Improper certificate validation in the HTTPS listener allows an unauthenticated remote attacker to impersonate a trusted client and gain full access to the cluster and managed virtual machines. The issue exists because the HTTPS API incorrectly validates every certificate in a supplied chain against the trust store instead of only validating the leaf certificate that proves ownership of the private key. By providing a crafted certificate chain containing a trusted client's public certificate, an attacker can authenticate as that client without possessing the corresponding private key. Depending on the privileges of the impersonated client, this can result in root access to the host machine. In MicroCloud environments, public certificates may be intercepted as a member joins the cluster.

Recommendations Update Canonical LXD to version 4.0.15. Update Canonical LXD to version 5.0.11. Update Canonical LXD to version 5.21.9. Update Canonical LXD to version 6.10.1. Update Canonical MicroCloud to version 2.1.5. Update Canonical MicroCloud to version 3.4.1. Restrict management API reachability to trusted networks to minimize the risk of exploitation.