CVE-2026-112816
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Coverage
Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
A certificate validation flaw in LXD and Incus lets a remote attacker append a trusted certificate's public part to their own chain and be accepted as its owner, bypassing authentication without credentials, a stolen private key or user interaction. Incus rates it critical with a CVSS score of 10.0 and says it has existed since the initial release, while Canonical's LXD record is CVE-2026-112816, which Ubuntu rates as Medium priority. Exposed HTTPS management listeners should be patched and restricted to trusted hosts, as neither advisory reports active exploitation.
Sources: NVD and CISA known exploited vulnerabilities catalogue.