LXD and MicroCloud certificate flaw allows trusted-client impersonation
A certificate-validation flaw affects remote API authentication in Canonical LXD and MicroCloud; administrators should review fixed snap releases.
Canonical has issued fixes for a certificate-validation flaw affecting LXD and MicroCloud. The flaw is tracked as CVE-2026-112816. It could let an attacker impersonate a trusted client without possessing that client's private key.
The conditions matter: an attacker needs network access to the HTTPS API and the public certificate of a client the server trusts. A standalone LXD installation does not expose that network API by default.
The flaw concerns which certificates in a presented chain the server accepts as proof of the client's identity. If the impersonated client has elevated privileges, the resulting access can be particularly serious. A critical severity rating does not, by itself, establish that attackers are exploiting a deployment.
Administrators should consult Canonical's advisory for the fixed release appropriate to their snap channel and verify the installed version after updating. The affected products and channel-specific fixes should be checked individually; this brief does not imply that every Ubuntu package or every LXD installation has the same exposure.
Sources
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private KeySupportingthehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning