Critical Flaw in Canonical LXD and MicroCloud Allows Unauthorized Client Impersonation

A maximum severity vulnerability in Canonical's LXD and MicroCloud virtualization software allows remote attackers to authenticate as trusted clients without holding their private keys, The Hacker News reported. Security advisories tracked the vulnerability under the identifier CVE-2026-112816, assigning it a maximum common vulnerability scoring system severity rating of 10.0. Exploiting the weakness enables unauthorized actors to gain administrative access across affected container clusters and guest virtual machines.

Flawed Certificate Chain Verification Mechanics

The security flaw stems from defective certificate validation logic during mutual transport layer security authentication sessions, The Hacker News reported. Remote management clients establish connections by presenting an identity certificate, which the server checks against its local trust repository. While standard protocols verify private key ownership solely for the initial leaf certificate, the vulnerable software inspected every certificate attached in the verification chain. Consequently, an attacker presenting their own valid leaf certificate could append an arbitrary public certificate belonging to a trusted client, causing the server to authenticate the attacker as that trusted party.

Exposure Requirements and Cluster Weaknesses

Because public certificates are designed for open verification and are not maintained as cryptographic secrets, obtaining them presents low technical difficulty. Standalone LXD servers avoid automatic exposure because the management interface listens only on a local internal socket unless administrators explicitly activate network access. In clustered MicroCloud deployments, Canonical stated that attackers intercepting public certificates during cluster node onboarding could subsequently impersonate that cluster member.

Vendor Patches and Mitigation Recommendations

The vulnerability was initially identified and reported by engineers from the Incus open-source project, The Hacker News noted. Engineers highlighted that the Incus 7.6.0 release resolved this vulnerability in addition to 17 other security problems affecting the platform, The Hacker News reported. Canonical released patched software packages across multiple supported snap distribution streams, including versions 6.10.1, 5.21.9, 5.0.11, and 4.0.15 for LXD alongside updates for MicroCloud. Furthermore, standard Ubuntu operating system software archive repositories are not affected because Canonical delivers the affected software and its updates primarily through snap distribution channels, The Hacker News noted. United States Cybersecurity and Infrastructure Security Agency assessments dated October 30 indicated no evidence of active in-the-wild exploitation. Security specialists advise system operators to apply vendor patches immediately and restrict external network access to management endpoints to prevent potential unauthorized access.

In September 2026, Canonical addressed multiple critical vulnerabilities in LXD referred from the Incus project and contributors that allowed authenticated users to achieve arbitrary command execution on the host system with root privileges, according to Canonical Ltd..