Critical LXD Flaw Enables Trusted Client Impersonation

A critical flaw in Canonical's LXD and MicroCloud allows an attacker to log in as a trusted client without holding that client's private key. The vulnerability, tracked as CVE-2026-112816, carries a maximum CVSS score of 10.0. To exploit the flaw, an attacker must reach the HTTPS API over the network and possess the trusted client's public certificate. Once inside, the attacker can act as the impersonated client with access to the cluster and its virtual machines. If the impersonated account is privileged, the attacker can gain root access to the host machine.

The flaw occurred because the server compared every certificate in the chain against the trust store, but TLS only proves ownership of the private key for the leaf certificate. An attacker can impersonate a trusted client by attaching their own certificate behind the trusted client's public certificate in the chain. The Incus project reported the flaw first, and Canonical confirmed it affects LXD as well. Incus fixed the same flaw in version 7.6.0. Affected LXD versions include 4.0.14, 5.0.10, 5.21.8, and 6.9 prior to their fixed releases.

Canonical has released fixed versions of LXD and MicroCloud to address the flaw. Users should update LXD and MicroCloud using the commands sudo snap refresh lxd and sudo snap refresh microcloud. Canonical's advisory notes that fixed LXD point releases were still rolling out from the candidate channel to stable at the time of the advisory. There is no public sign that the flaw has been used in an attack, and it is not on CISA's Known Exploited Vulnerabilities list.