LXD and MicroCloud: patch CVE-2026-112816, a critical certificate-chain login bypass

In brief

Developing. Last updated 2 November 2026, 08:11 Dubai time (UTC+4).

Canonical has fixed CVE-2026-112816, which it calls a critical vulnerability in LXD and MicroCloud. According to its advisory, an attacker who can reach the LXD HTTPS API can authenticate as any trusted TLS client whose public certificate they hold. Canonical urges all LXD and MicroCloud users to update immediately.

What is wrong

Canonical says the remote API's mutual TLS logic compared every certificate the client sent against the trust store, although only the leaf certificate proves ownership of the signing key. An attacker could therefore place a trusted client's public certificate in the chain as an intermediate and be accepted as that client. In MicroCloud, Canonical adds, an attacker can intercept the public TLS certificate of a joining cluster member and then authenticate as that member.

The flaw was referred to Canonical by the Incus project.

Impact

Canonical's advisory says an attacker may impersonate another user with only their public client certificate and, depending on that user's privileges, may gain root access to the host. Canonical's CVE page describes the result as full access to the cluster and managed virtual machines.

Affected and fixed versions

Canonical's CVE page says LXD versions before 4.0.15, 5.0.11, 5.21.9 and 6.10.1 are affected. The advisory lists these fixed snaps, all released on 29 October:

• lxd 6.10.1 (6/stable)
• lxd 5.21.9 (5.21/stable)
• lxd 5.0.11 (5.0/stable)
• lxd 4.0.15 (4.0/stable)
• microcloud 3.4.1 (3/stable)
• microcloud 2.1.5 (2/stable)

The CVE page marks the lxd package as "Not in release" or "Not affected" for Ubuntu 16.04 to 26.10, so the fix ships through the snaps. Canonical does not list affected MicroCloud versions beyond the fixed ones.

How to update

Canonical says all users must update to the latest version in their channel:

sudo snap refresh lxd
sudo snap refresh microcloud

Canonical noted that "All LXD point releases are currently in progressive roll out from candidate to stable."

Workarounds

Canonical's advisory gives no workaround. Updating is the only remedy it lists.

Why it matters

Public certificates are not secrets, so the main barrier here is network reach to the API. Because the stable rollout was progressive, administrators should confirm each host, and every cluster member, now runs a fixed version rather than assuming one refresh covered the fleet.

Sources and scope

• Canonical security advisory: Critical vulnerability found in Canonical LXD and MicroCloud (Ubuntu Discourse, 28 October 2026)
• Ubuntu Security: CVE-2026-112816 (published 30 October 2026)
• LXD 6.10.1 LTS release notes (Ubuntu Discourse)

Canonical's advisory calls the flaw critical. The Ubuntu CVE page rates the deb package Medium priority; it does not give a reason, and LXD's fixes ship as snaps.

All facts come from Canonical. Canonical's GitHub advisory could not be read, so no CVSS score is given. The "Why it matters" section is ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.