{"id":"CVE-2026-112816","kind":"vulnerability","aliases":["CVE-2026-112816"],"related":[],"title":"Canonical LXD: flawed certificate checks let attackers log in as trusted clients","description":"Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.","summary":"The HTTPS listener in Canonical LXD does not properly validate client certificate chains. An unauthenticated attacker can present a crafted certificate chain and gain full access to the cluster and the virtual machines it manages.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["canonical","infrastructure","linux","lxd","self-hosted","virtualization"],"not_affected_if":["https-listener-disabled","lxd-not-installed","not-internet-reachable"],"how_to_check":"- Check the installed LXD version with `lxd --version` and compare it against the affected ranges.\n- Look for LXD servers that expose the HTTPS API (port 8443 by default) to networks the attacker can reach.\n- Check whether the server is part of an LXD cluster, since the sources say the whole cluster is exposed.","fix":"- LXD 4.0 branch: move to `4.0.15`\n- LXD 5.0 branch: move to `5.0.11`\n- LXD 5.21 branch: move to `5.21.9`\n- LXD 6.x branch: move to `6.10.1`","status":"open","published_at":"2026-10-30T17:17:14+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:02+00:00","updated_at":"2026-10-30T17:32:02+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T17:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- LXD 4.0 branch: move to `4.0.15`\n- LXD 5.0 branch: move to `5.0.11`\n- LXD 5.21 branch: move to `5.21.9`\n- LXD 6.x branch: move to `6.10.1`","reach":"network","title":"Canonical LXD: flawed certificate checks let attackers log in as trusted clients","impact":"high","summary":"The HTTPS listener in Canonical LXD does not properly validate client certificate chains. An unauthenticated attacker can present a crafted certificate chain and gain full access to the cluster and the virtual machines it manages.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["lxd","canonical","self-hosted","virtualization","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains full cluster access and control of managed virtual machines","analyst_note":"Confirm whether the HTTPS listener is enabled by default and whether the affected range includes 6.9 as a separate branch; check the Canonical LXD security advisory for exact fixed versions.","how_to_check":"- Check the installed LXD version with `lxd --version` and compare it against the affected ranges.\n- Look for LXD servers that expose the HTTPS API (port 8443 by default) to networks the attacker can reach.\n- Check whether the server is part of an LXD cluster, since the sources say the whole cluster is exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["lxd-not-installed","https-listener-disabled","not-internet-reachable"],"who_is_affected":"Any LXD server that accepts HTTPS connections from the network is exposed, including members of an LXD cluster. Servers reachable only from a trusted local machine or behind strict network controls carry less risk. The sources do not say which default configuration, if any, is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000765,"input_tokens":4180,"output_tokens":694,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112816':15A,18A '-2026':14A,17A '4.0.14':72C '4.0.15':77C '5.0.10':73C '5.0.11':78C '5.21.8':74C '5.21.9':79C '6.10.1':80C '6.9':75C 'access':52B,94C 'allow':81C 'attack':7A,42B,84C 'authent':86C 'canon':1A,19B,31B,70C 'certif':4A,38B,47B,63C,105C 'chain':39B,48B,106C 'check':5A 'client':12A,37B,90C 'cluster':55B,97C 'craft':46B,104C 'cve':13A,16A 'flaw':3A 'full':51B,93C 'gain':50B,92C 'host':25B 'https':28B,67C 'improp':62C 'infrastructur':20B 'let':6A 'linux':21B 'listen':29B,68C 'log':8A 'lxd':2A,22B,32B,71C 'machin':59B,101C 'manag':61B,99C 'present':44B 'proper':35B 'self':24B 'self-host':23B 'trust':11A,89C 'unauthent':41B,83C 'valid':36B,64C 'via':102C 'virtual':26B,58B,100C","nicknames":[],"mitigations":[],"who_affected":"Any LXD server that accepts HTTPS connections from the network is exposed, including members of an LXD cluster. Servers reachable only from a trusted local machine or behind strict network controls carry less risk. The sources do not say which default configuration, if any, is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@ubuntu.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112816","severity":null,"published_at":"2026-10-30T17:17:14+00:00","modified_at":"2026-10-30T17:17:14+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}