{
  "id": 17577081,
  "title": "The handshake only proves the leaf: LXD's CVSS 10.0 certificate mix-up",
  "url": "https://urgent.news/2026/11/01/the-handshake-only-proves-the-leaf-lxds-cvss-10-0-certificate-mix-up",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T10:07:52.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/damiano_builds/the-handshake-only-proves-the-leaf-lxds-cvss-100-certificate-mix-up-2a0p"
  },
  "original_language": "en",
  "account": "LXD, a system container and virtual machine manager from Canonical, and MicroCloud, a cloud clustering system, both use mutual TLS to authenticate remote clients over HTTPS. Mutual TLS requires both the server and client to prove their identities, with the client presenting a certificate that the server trusts. The problem lies in how LXD and MicroCloud validate these certificates. They only check if the client's certificate is in their trust store, not if the client actually owns the private key for that certificate. This means an attacker could present a trusted client's certificate and impersonate that client, gaining unauthorized access to the system. The attacker only needs network access to the HTTPS API and a trusted client's public certificate. This flaw, CVE-2026-112816, has a CVSS score of 10.0, indicating a high severity. It affects LXD versions 4.0.14 and prior, 5.0.10 and prior, 5.21.8 and prior, and 6.9. Ubuntu's archive packages of LXD are not affected. To mitigate the risk, users should refresh their LXD and MicroCloud installations to the latest versions where the fix is applied.",
  "summary": "Mutual TLS is supposed to settle the question of identity in both directions. The server proves itself to the client, the client proves itself to the server, and both sides walk away knowing who they are talking to. This week Canonical disclosed a bug that shows how thin the line is between \"we use mTLS\" and \"we actually verified the client\": CVE-2026-112816, a maximum-severity flaw in LXD and…",
  "key_points": [
    "LXD and MicroCloud use mutual TLS for client authentication.",
    "Certificates are only checked against trust store, not private key ownership.",
    "Vulnerability CVE-2026-112816 has CVSS 10.0 severity."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}