Critical · 1 source · latest 21h

Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts

CRITICAL · VULNERABILITYCanonicalredteam/daily · 1 source

Severity: Critical
Highest CVSS: 10.0
Exploited: Not known
Sources: 1

What happened

A certificate validation flaw in LXD and Incus lets a remote attacker append a trusted certificate's public part to their own chain and be accepted as its owner, bypassing authentication without credentials, a stolen private key or user interaction. Incus rates it critical with a CVSS score of 10.0 and says it has existed since the initial release, while Canonical's LXD record is CVE-2026-112816, which Ubuntu rates as Medium priority. Exposed HTTPS management listeners should be patched and restricted to trusted hosts, as neither advisory reports active exploitation.

For IT people · Written by AI from 1 source · Wrong?

What to do

Update Incus to version 7.6.0 or later.
Update LXD to 4.0.15, 5.0.11, 5.21.9 or 6.10.1 for the relevant release branch.
Restrict access to the HTTPS management listener to trusted hosts until patches are applied.
Check installed versions against the relevant vendor advisory.