Detections
Analytics

CVE-2026-112816

critical

Description

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

References

https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4

https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557

https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024

https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1

https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1

https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571

Details

Source: Mitre, NVD

Published: 2026-10-30

Updated: 2026-10-30

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

CVSS v4

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical