Canonical has fixed CVE-2026-112816, rated 10.0, in LXD and MicroCloud, The Hacker News reports. The server checked every certificate the client sent against its trust store, while a TLS connection only proves ownership of the key for the first one, so attaching a trusted client's public certificate was enough. With a privileged account the attacker could reach root on the host. Fixed snap versions are LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5, with no known exploitation.

What it means: LXD is used by small hosting providers, labs and companies running their own virtual machine clusters, often without a dedicated security team. The bug is a textbook authentication logic error: a public certificate is not a secret, yet the server treated it as proof. The risk is higher in MicroCloud, where someone watching a new node join the cluster can capture the certificate they need. A standalone LXD server does not expose its API to the network by default, so the first step is to check whether HTTPS access has been switched on. Where it has, the upgrade should happen at once, confirming the version actually installed, since Canonical said the fixes were still moving into the stable channel. Until then, limiting API access to known addresses or a VPN reduces the risk. For anyone managing infrastructure for clients, a flaw that gives full control of the host means possible access to every hosted system, so a review of logs for unusual connections is worthwhile.

Read the original on The Hacker News

Related service: Custom software

Related stories