LXD and MicroCloud flaw CVE-2026-112816 (CVSS 10.0) lets attackers impersonate trusted TLS clients

TLDR

• Canonical's LXD and MicroCloud flaw CVE-2026-112816 scores CVSS 10.0 and lets attackers impersonate a trusted client.¹³
• Fixed snaps are LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5; Incus fixed it in 7.6.0.²⁵
• CISA's 30 October assessment lists exploitation as none; the only workaround is restricting network access to the HTTPS listener.³⁵

Canonical has fixed a critical flaw in LXD and MicroCloud, tracked as CVE-2026-112816, that lets an attacker who can reach the LXD HTTPS API authenticate as any trusted TLS client for which the attacker holds the public certificate.² The Hacker News reports that the flaw carries the maximum CVSS score of 10.0, and the CVE record lists CVSS v4.0 10.0 with no privileges or user interaction required.¹³ Canonical says that, depending on the privileges of the impersonated user, the attacker may gain root access to the host machine, while the CVE record describes full access to the cluster and managed virtual machines via a crafted certificate chain.²³

Canonical says the remote API's mutual TLS logic compared every certificate the client sent against known trust store entries, although only the leaf certificate proves ownership of the signing key.² An attacker could therefore place a trusted public certificate in the chain behind their own and be accepted as that identity.² The Incus project, which Canonical says referred the flaw to it, states that Incus has had the same flaw since its initial release.²⁵ The CVE record credits Stéphane Graber as reporter.³ The Hacker News reports that a standalone LXD server listens only on a local socket unless an administrator enables the network API with core.https_address, and Ostorlab says the cluster listener should also be checked.¹⁶ For MicroCloud, Canonical says an attacker who intercepts the public certificate of a joining cluster member can then authenticate as that member.² For Incus, the project says server certificates are returned by every TLS handshake, so no prior access is needed to obtain one.⁵

Canonical lists fixed snaps LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5, each dated 29 October, and urges all users to update immediately.² It also says the LXD point releases were in progressive rollout from the candidate channel to stable, so The Hacker News advises checking the installed version after refreshing.¹² Incus 7.6, released on 30 October, fixes 18 security issues, and its release post rates this one critical.⁷ The CVE record lists LXD 4.0.14, 5.0.10, 5.21.8 and 6.9.0 as affected before the fixed releases, and does not list MicroCloud.³ Ostorlab gives wider ranges: LXD 6.9.0 to 6.10.0, everything through 5.21.8, 5.0.10 and 4.0.14, MicroCloud before 3.4.1 and 2.1.5, and all Incus releases before 7.6.0.⁶

On exploitation, the CISA-ADP entry in the CVE record, timestamped 30 October, lists Exploitation as none, Automatable as yes and Technical Impact as total.³ The Hacker News reports the flaw is not on CISA's Known Exploited Vulnerabilities list and that no working exploit has been published, while Ostorlab says it was not in the catalogue as of 1 November and that the vendor advisories it cites link no public proof of concept.¹⁶ The Hacker News reports that Canonical's advisory gives no temporary workaround for LXD, and the Incus advisory says there is no configuration-based workaround, only restricting network access to the HTTPS listener to trusted hosts.¹⁵ Ubuntu's CVE page lists the lxd package as not in the 22.04, 24.04, 26.04 and 26.10 releases and not affected in 16.04, 18.04 and 20.04, and Ostorlab says the Ubuntu archive carries no affected LXD package.⁴⁶ Canonical's advisory is dated 28 October and the Incus advisory 29 October, the CVE record was published on 30 October, and The Hacker News and Ostorlab published on 1 November.²⁵³¹⁶

Why it matters: a CVSS 10.0 flaw that needs only network reach to the HTTPS API and a trusted client's public certificate puts exposed LXD, MicroCloud and Incus listeners at risk of full cluster access, so operators need to confirm which listeners are reachable and that a fixed version is running.¹²³⁵