Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11021 | Publication Date: 02 November 2026

Critical Authentication Bypass in Canonical LXD & MicroCloud
CVE-2026-112816

Summary

A critical authentication bypass vulnerability has been identified in Canonical LXD and MicroCloud. The vulnerability, tracked as CVE-2026-112816, has been assigned a CVSS v4.0 score of 10.0 (Critical) — the maximum possible severity.

An unauthenticated remote attacker can craft a malicious certificate chain and successfully authenticate as any trusted client without possessing the corresponding private key. Successful exploitation grants full access to the LXD cluster and all managed virtual machines. If the impersonated client has elevated privileges, the attacker may also achieve root access on the host system.

Technical Overview

The vulnerability exists due to improper certificate validation (CWE-295) in the HTTPS listener’s mutual TLS (mTLS) authentication logic. LXD verifies certificates against the trust store but fails to properly confirm that the client actually possesses the private key for the leaf certificate. An attacker can append the public certificate of a trusted client to their own certificate chain and be accepted as that identity.

The HTTPS listener is disabled by default. However, any deployment that has enabled remote API access (particularly clustered environments and MicroCloud installations) is exposed.

Affected Systems

  • Canonical LXD 4.0.14 (fixed in 4.0.15)
  • Canonical LXD 5.0.10 (fixed in 5.0.11)
  • Canonical LXD 5.21.8 (fixed in 5.21.9)
  • Canonical LXD 6.9 (fixed in 6.10.1)
  • Canonical MicroCloud (affected versions fixed in 2.1.5 and 3.4.1)
  • Incus (fork) — fixed in 7.6.0

Recommendations

  1. Immediate Action: Upgrade LXD and MicroCloud to the fixed versions as soon as possible using the official snap packages.
  2. If remote HTTPS API access is not required, disable the HTTPS listener immediately.
  3. Restrict network access to the LXD API to trusted management networks only until the patch is applied.
  4. Review the trust store and revoke any certificates that may have been compromised.
  5. Monitor authentication logs for unusual client certificate activity.

Organizations running LXD or MicroCloud in production, especially clustered environments, should treat this vulnerability as high priority due to the complete authentication bypass and potential for full system compromise.

Support from KSRC

KSRC (Karen IT Security Response Center) is fully prepared to assist organizations with any questions, technical guidance, or incident-related issues arising from this vulnerability.

Whether you require help with impact assessment, mitigation planning, or response coordination, our team is available.

Karen IT
We make the Internet harder to abuse.