Vulnerabilities · 3h ago

LXD flaw lets public certificates impersonate trusted clients

Canonical patched a CVSS 10.0 flaw in LXD and MicroCloud that could let an attacker impersonate a trusted client; the Incus project, a community fork of LXD, reported the bug, and Incus is affected too.

The products use mutual TLS, which checks a client certificate to establish identity. The server searched every certificate the client supplied for a trusted one, although TLS proves possession only of the private key matching the first certificate. An attacker with access to the HTTPS API and a trusted client's public certificate could therefore be accepted as that client—without its private key—and inherit its cluster permissions. A privileged identity could give access to host root.

If a cluster's API is reachable, or an attacker can capture a MicroCloud member certificate during joining, that identity's permissions can extend across the cluster and its virtual machines. CISA has not listed the flaw as known exploited, but that does not establish whether a specific exposed cluster was accessed.

CVE-2026-112816

NVD KEV

EPSS 0.3% (23rd percentile).

Timeline

Nov 1 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Nov 1
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
Canonical patches CVE-2026-112816 in LXD and MicroCloud, a CVSS 10.0 flaw enabling trusted client impersonation without private keys.

Entities

CVE-2026-112816

Part of the PlainSec briefing for 2026-11-01

Editions

Briefing for 2026-11-01

Vulnerabilities · 3h agoLXD flaw lets public certificates impersonate trusted clientsCanonical patched a CVSS 10.0 flaw in LXD and MicroCloud that could let an attacker impersonate a trusted client; the Incus project, a community fork of LXD, reported the bug, and Incus is affected too.The products use mutual TLS, which checks a client certificate to establish identity. The server searched every certificate the client supplied for a trusted one, although TLS proves possession only of the private key matching the first certificate. An attacker with access to the HTTPS API and a trusted client's public certificate could therefore be accepted as that client—without its private key—and inherit its cluster permissions. A privileged identity could give access to host root.If a cluster's API is reachable, or an attacker can capture a MicroCloud member certificate during joining, that identity's permissions can extend across the cluster and its virtual machines. CISA has not listed the flaw as known exploited, but that does not establish whether a specific exposed cluster was accessed.