Critical severityNVD Advisory· Published Oct 30, 2026· Updated Oct 30, 2026
CVE-2026-112816
CVE-2026-112816
Description
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Patches
Vulnerability mechanics
References
6- discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571nvd
- discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1nvd
- discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1nvd
- discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024nvd
- discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557nvd
- github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4nvd
News mentions
0No linked articles in our index yet.