home / blog
2026-10-31 · critical
CVE-2026-112816: LXD Certificate Validation Bypass
Certificate spoofing in Canonical LXD 4.0.14-6.9 enables complete cluster and VM access. CVSS 10.0.
CVE-2026-112816 describes improper certificate validation in the HTTPS listener of Canonical LXD (versions 4.0.14, 5.0.10, 5.21.8, 6.9). An unauthenticated attacker can craft a certificate chain to impersonate a trusted client and gain complete access to the LXD cluster and managed virtual machines. This represents full unauthorized access to virtualized infrastructure.
The vulnerability has a CVSS score of 10.0 (maximum), classified as critical. It was published on NVD on October 30, 2026. No public exploits are reported on GitHub repositories. On X platform, 3 posts are observed in the last 24 hours discussing the vulnerability, indicating initial community awareness. Patches are available as of the publication date.
System administrators must update LXD to the corrected versions (4.0.15, 5.0.11, 5.21.9, 6.10.1 or later) with maximum priority. Before updating, verify which version is running on production clusters and plan a maintenance window. If immediate updates are not possible, consider restricting HTTPS listener access to isolated and trusted networks only, while understanding this is not a complete mitigation.
At a glance
- What
- Improper HTTPS certificate validation in Canonical LXD allows unauthenticated attackers to craft a certificate chain to impersonate trusted clients and gain full access to LXD clusters and managed virtual machines.
- Severity
- CVSS 10.0 (maximum) – critical. Complete unauthenticated access to LXD cluster and managed virtual machines.
- Affected versions
- LXD 4.0 up to 4.0.14; 5.0 up to 5.0.10; 5.21 up to 5.21.8; 6.x up to 6.9. Fix: 4.0.15, 5.0.11, 5.21.9, 6.10.1 or later.
- Fix
- Update to version 4.0.15, 5.0.11, 5.21.9, 6.10.1 or later depending on the release series in use. Update with maximum priority.
- Status
- Published on NVD on 2026-10-30. Patches available. 3 posts reported on X platform in the last 24 hours. No public exploit reported on GitHub repositories.
- Action
- Inventory LXD clusters in production. Apply patches with maximum priority. If immediate update not possible, restrict HTTPS listener access to isolated and trusted networks only (not a complete mitigation).
Sources: NVD, CVE-2026-112816