Incus
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by Cyber Security NewsCritical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
- Vulnerability reported by GBHackersCritical certificate-validation flaws in Incus and LXD allow unauthenticated cluster takeover
Recent news
Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
A certificate validation flaw in LXD and Incus lets a remote attacker append a trusted certificate's public part to their own chain and be accepted as its owner, bypassing authentication without credentials, a stolen private key or user interaction. Incus rates it critical with a CVSS score of 10.0 and says it has existed since the initial release, while Canonical's LXD record is CVE-2026-112816, which Ubuntu rates as Medium priority. Exposed HTTPS management listeners should be patched and restricted to trusted hosts, as neither advisory reports active exploitation.
Critical certificate-validation flaws in Incus and LXD allow unauthenticated cluster takeover
Critical certificate-validation vulnerabilities in Incus and Canonical LXD let unauthenticated attackers with network access to the HTTPS listener impersonate trusted identities. Exploitation does not need valid credentials or the private key of a trusted certificate, and the LXD flaw may expose entire clusters.