Improper Certificate Validation in Canonical LXD by Canonical
CVE-2026-112816

10CRITICAL

Key Information:

Vendor

Canonical

Status
Lxd
Vendor
CVE Published:
30 October 2026

What is CVE-2026-112816?

An improper certificate validation vulnerability exists in the HTTPS listener of Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9 prior to the recommended updates. This flaw enables unauthenticated attackers to forge a certificate chain, allowing them to masquerade as a legitimate trusted client. Consequently, they can gain unauthorized access to the cluster and its managed virtual machines, significantly compromising security within the environment. Users are advised to update to the latest versions promptly to mitigate this risk.

Affected Version(s)

LXD Linux 4.0.14 < 4.0.15

LXD Linux 5.0.10 < 5.0.11

LXD Linux 5.21.8 < 5.21.9

References

https://github.com/canonical/lxd/security/advisories/GHSA...
vendor-advisory
https://discourse.ubuntu.com/t/security-advisory-critical...
vendor-advisory
https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-re...
release-notes

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stéphane Graber
.