Live › vulnerability › CVE-2026-112816
The HTTPS listener in Canonical LXD does not properly validate client certificate chains. An unauthenticated attacker can present a crafted certificate chain and gain full access to the cluster and the virtual machines it manages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Any LXD server that accepts HTTPS connections from the network is exposed, including members of an LXD cluster. Servers reachable only from a trusted local machine or behind strict network controls carry less risk. The sources do not say which default configuration, if any, is required.
No product ranges from the sources yet.
lxd --version and compare it against the affected ranges.4.0.155.0.115.21.96.10.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
This page as .md · .json · in your agent: get_signal("CVE-2026-112816")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.