CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is
A critical vulnerability was recently discovered in Canonical's LXD and MicroCloud virtualization platforms, allowing attackers to impersonate trusted clients without a private key. This flaw, identified as CVE-2026-112816, grants attackers access to the cluster and its virtual machines, potentially granting root access to the host machine if the impersonated account is privileged.
The vulnerability, carried a maximum CVSS score of 10.0, meaning it is considered extremely critical. Canonical has released updated versions of both LXD and MicroCloud to address the issue.
LXD and MicroCloud enable remote clients to access their APIs over mutual TLS, requiring the client to present a certificate to prove its identity. The server checks the certificate against its trust store, which contains the identities it will accept. However, the comparison only verifies the first certificate in the chain, known as the leaf certificate.
Attackers can exploit this by attaching their own certificate to the chain and presenting the trusted client's public certificate, which is not secret, to the server. The server will then accept the attacker as the trusted client, granting them access to the cluster and its virtual machines.
To exploit this vulnerability, attackers need network access to the HTTPS API and the public certificate of a trusted client. However, a standalone LXD server does not expose this API by default; it listens only on a local socket. MicroCloud, on the other hand, has a specific weakness, as an attacker who can intercept a member's public certificate during cluster membership can log in as that member.
The affected versions of LXD are 4.0.14, 5.0.10, 5.21.8, and 6.9, while the affected versions of MicroCloud are not specified in the source material.
Canonical has released fixed point releases for both LXD and MicroCloud, listed in their advisory. Snap users can update their installations by running "sudo snap refresh lxd" and "sudo snap refresh microcloud". The vulnerability has not been publicly exploited, and there is no evidence that it has been used in an attack. However, it is essential to update LXD and MicroCloud to the fixed versions to mitigate the risk.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
