Ethical Hacking News
A critical flaw in Canonical's LXD and MicroCloud has been discovered, allowing attackers to impersonate trusted clients without a private key. This vulnerability, tracked as CVE-2026-112816, carries a maximum CVSS score of 10.0 and has been assigned a high level of severity by security experts. To mitigate this risk, users are advised to update their systems to the latest fixed versions and take steps to restrict network access to the listener. This is a critical update for all users, and it's essential to stay informed about the latest security patches and best practices to protect against this type of vulnerability.
LXD and MicroCloud have a critical vulnerability (CVE-2026-112816) allowing attackers to impersonate trusted clients without a private key. The vulnerability affects LXD 4.0.14, 5.0.10, 5.21.8, and 6.9, as well as MicroCloud. Incus project fixed the same flaw in version 7.6.0 before Canonical. Update to the fixed versions is advised, with no temporary workaround for LXD. Limiting network access to the listener and considering the Incus version can reduce the risk.
A recent vulnerability in Canonical's LXD and MicroCloud has been identified, allowing attackers to impersonate trusted clients without a private key. This critical flaw, tracked as CVE-2026-112816, carries a maximum CVSS score of 10.0 and has been assigned a high level of severity by security experts.
The vulnerability was discovered in the mutual TLS setup, where clients present a certificate to prove their identity. In this setup, clients are trusted when their certificate is in the server's trust store, the list of identities the server will accept. However, the flaw was in how the server checked that certificate, comparing every certificate the client sent against the trust store, but only proving the client owns the private key for the first certificate in the chain, the leaf.
An attacker could take a trusted client's public certificate, which is not secret, attach it to the chain behind their own, and the server would accept them as that client. This would grant the attacker access to the cluster and its virtual machines, potentially leading to a breach of sensitive data and compromising the security of the entire system.
The vulnerability affects LXD 4.0.14, 5.0.10, 5.21.8, and 6.9, as well as MicroCloud, which ties several machines running LXD into one cluster. However, it's worth noting that the Incus project, which began as a community fork of LXD, reported the flaw before Canonical, and Incus fixed the same flaw in version 7.6.0.
To mitigate this vulnerability, users are advised to update LXD and MicroCloud to the fixed versions. On a snap install, running `sudo snap refresh lxd` and `sudo snap refresh microcloud` can refresh the fixed versions. However, there is no temporary workaround for LXD, and limiting network access to the listener can reduce the risk until an update can be applied.
In the meantime, users are advised to restrict network access to the listener and consider moving to Incus's fixed version 7.6.0, which addressed the same flaw.
The discovery of this vulnerability highlights the importance of regular security updates and the need for users to stay informed about the latest security patches and best practices.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Flaw-in-LXD-and-MicroCloud-Allowing-Attackers-to-Impersonate-Trusted-Clients-Without-a-Private-Key-ehn.shtml
https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html
Published: Sun Nov 1 04:19:19 2026 by llama3.2 3B Q4_K_M
