The handshake only proves the leaf: LXD's CVSS 10.0 certificate mix-up
Mutual TLS is supposed to settle the question of identity in both directions. The server proves itself to the client, the client proves itself to the server, and both sides walk away knowing who they are talking to. This week Canonical disclosed a bug that shows how thin the line is between "we use mTLS" and "we actually verified the client": CVE-2026-112816, a maximum-severity flaw in LXD and…
LXD, a system container and virtual machine manager from Canonical, and MicroCloud, a cloud clustering system, both use mutual TLS to authenticate remote clients over HTTPS. Mutual TLS requires both the server and client to prove their identities, with the client presenting a certificate that the server trusts. The problem lies in how LXD and MicroCloud validate these certificates.
They only check if the client's certificate is in their trust store, not if the client actually owns the private key for that certificate. This means an attacker could present a trusted client's certificate and impersonate that client, gaining unauthorized access to the system. The attacker only needs network access to the HTTPS API and a trusted client's public certificate.
This flaw, CVE-2026-112816, has a CVSS score of 10.0, indicating a high severity. It affects LXD versions 4.0.14 and prior, 5.0.10 and prior, 5.21.8 and prior, and 6.9. Ubuntu's archive packages of LXD are not affected. To mitigate the risk, users should refresh their LXD and MicroCloud installations to the latest versions where the fix is applied.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
