- Canonical disclosed a critical flaw in LXD and MicroCloud that allows complete authentication bypass, carrying a maximum CVSS score of 10.0.
- The vulnerability, tracked as CVE-2026-112816, lets an attacker impersonate a trusted client by attaching that client’s public certificate to their own TLS chain.
- Exploitation requires network access to the HTTPS API and the trusted client’s public certificate, with MicroCloud clusters being particularly at risk during member onboarding.
- Canonical has released fixed snap versions for all affected product lines, and the Incus project, which originally reported the bug, fixed it in version 7.6.0.
A critical authentication bypass vulnerability in Canonical’s LXD and MicroCloud systems, disclosed on November 1, 2026, lets attackers impersonate any trusted client to gain full control of virtual machines and potentially the host machine. The flaw, tracked as CVE-2026-112816, carries a maximum CVSS score of 10.0 and affects all supported versions of both products.
The vulnerability stems from how the server validates client certificates during mutual TLS authentication. While a TLS connection only proves ownership of the private key for the first certificate in the chain, the server incorrectly compared every certificate the client sent against its trust store. Consequently, an attacker could take a trusted client’s public certificate, which is not secret, attach it to the chain behind their own leaf certificate, and the server would accept them as that trusted client.
Exploitation requires two conditions: network access to the HTTPS API and possession of a trusted client’s public certificate. A standalone LXD server does not expose this API by default, only listening on a local socket unless an administrator enables the network API. However, MicroCloud, which ties several machines into a cluster, presents a specific weak point, as attackers who capture a member’s public certificate during cluster join can then log in as that member.
Canonical has released fixed snap versions for all affected channels, including LXD 6.10.1 and MicroCloud 3.4.1. The bug did not originate at Canonical; the Incus project, which began as a community fork of LXD, reported it and fixed the same flaw in version 7.6.0.
There is no public sign the flaw has been exploited. The U.S. CISA assessment, dated October 30, states the flaw is not known to have been exploited and no working exploit has been published. Canonical advises administrators to update LXD and MicroCloud to the fixed versions, noting that no temporary workaround exists and that limiting network access to the API reduces risk until the update is applied.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Polymarket hit by $2.6M hack via compromised DebugBear script
- Chainalysis Hit by AI Agentic Attack, Customer Data Exposed.
- Chainalysis Hit by Cybersecurity Incident; No Sensitive Data Breached
- CISA Adds Two Ivanti Connect Secure Vulnerabilities to KEV
- ChatGPT Share Link Flaw Let Hackers Read Private Chats
