LXD
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by Cyber Security NewsCritical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
- Vulnerability reported by The Hacker NewsCritical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation
Recent news
Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
A certificate validation flaw in LXD and Incus lets a remote attacker append a trusted certificate's public part to their own chain and be accepted as its owner, bypassing authentication without credentials, a stolen private key or user interaction. Incus rates it critical with a CVSS score of 10.0 and says it has existed since the initial release, while Canonical's LXD record is CVE-2026-112816, which Ubuntu rates as Medium priority. Exposed HTTPS management listeners should be patched and restricted to trusted hosts, as neither advisory reports active exploitation.
Critical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation
Canonical's LXD and MicroCloud contain a critical flaw, rated CVSS 10.0, that allows authentication as a trusted client without its private key. An attacker needs network access to the HTTPS API and the target client's public certificate. Once authenticated, they act as that client with access to the cluster and its virtual machines.