CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD

Descripción

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4 vendor-advisory
• https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557 vendor-advisory
• https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024 release-notes
• https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1 release-notes
• https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1 release-notes
• https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571 release-notes