Critical · 1 source · latest 22h

Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts

CRITICAL · VULNERABILITYIncusredteam/daily · 1 source

Severity: Critical
Highest CVSS: 10.0
Exploited: Not known
Sources: 1

What happened

CVE-2026-112816 (LXD, Canonical) and an unnumbered Incus advisory describe an unauthenticated certificate validation flaw in the HTTPS management listener. The server verifies only the first certificate's private key during the TLS handshake, but compares every certificate in the client-supplied chain against the trust store, so attackers can append a trusted public certificate and impersonate its owner. Incus affects versions before 7.6.0 (CVSS 10.0); LXD fixes are 4.0.15, 5.0.11, 5.21.9 and 6.10.1. Patch, restrict HTTPS listener access to trusted hosts (no configuration workaround exists), and review trust store and cluster membership for unexpected entries.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Update Incus to version 7.6.0 or later.
Update LXD to 4.0.15, 5.0.11, 5.21.9 or 6.10.1 for the relevant release branch.
Restrict access to the HTTPS management listener to trusted hosts until patches are applied.
Check installed versions against the relevant vendor advisory.