10.0Critical
CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD
Description
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Weakness (CWE):
CWE-295
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4 vendor-advisory
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557 vendor-advisory
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024 release-notes
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1 release-notes
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1 release-notes
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571 release-notes