Canonical
CompanySecurity timeline
- Vulnerability reported by Cyber Security NewsCritical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
- Vulnerability reported by GBHackersCritical certificate-validation flaws in Incus and LXD allow unauthenticated cluster takeover
- Vulnerability reported by The Hacker NewsCritical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation
Recent news
Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
A certificate validation flaw in LXD and Incus lets a remote attacker append a trusted certificate's public part to their own chain and be accepted as its owner, bypassing authentication without credentials, a stolen private key or user interaction. Incus rates it critical with a CVSS score of 10.0 and says it has existed since the initial release, while Canonical's LXD record is CVE-2026-112816, which Ubuntu rates as Medium priority. Exposed HTTPS management listeners should be patched and restricted to trusted hosts, as neither advisory reports active exploitation.
Critical certificate-validation flaws in Incus and LXD allow unauthenticated cluster takeover
Critical certificate-validation vulnerabilities in Incus and Canonical LXD let unauthenticated attackers with network access to the HTTPS listener impersonate trusted identities. Exploitation does not need valid credentials or the private key of a trusted certificate, and the LXD flaw may expose entire clusters.
Critical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation
Canonical's LXD and MicroCloud contain a critical flaw, rated CVSS 10.0, that allows authentication as a trusted client without its private key. An attacker needs network access to the HTTPS API and the target client's public certificate. Once authenticated, they act as that client with access to the cluster and its virtual machines.