CVE-2026-112816

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.14 through 4.0.14 Canonical LXD versions 5.0.10 through 5.0.10 Canonical LXD versions 5.21.8 through 5.21.8 Canonical LXD versions 6.9 through 6.9

Description Improper certificate validation in the HTTPS listener allows an unauthenticated attacker to authenticate as any trusted client. By using a crafted certificate chain, the attacker can gain full access to the cluster and managed virtual machines.

Recommendations Update Canonical LXD version 4.0.14 to 4.0.15. Update Canonical LXD version 5.0.10 to 5.0.11. Update Canonical LXD version 5.21.8 to 5.21.9. Update Canonical LXD version 6.9 to 6.10.1.