{"id":12342,"date":"2026-11-01T16:10:14","date_gmt":"2026-11-01T22:10:14","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/advisory-2026-135-critical-vulnerability-in-canonical-lxd-and-microcloud-allows-trusted-clients-to-be-impersonated\/"},"modified":"2026-11-01T16:28:41","modified_gmt":"2026-11-01T22:28:41","slug":"alert-2026-135-critical-flaw-in-canonical-lxd-and-microcloud-allows-impersonation-of-trusted-clients","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-135-critical-flaw-in-canonical-lxd-and-microcloud-allows-impersonation-of-trusted-clients\/","title":{"rendered":"Alert 2026-135 Critical flaw in Canonical LXD and MicroCloud allows impersonation of trusted clients"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product (snap track)<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
Canonical LXD, track 6 \/ latest<\/strong><\/td>Before 6.10.1<\/td>6.10.1<\/td><\/tr>
Canonical LXD, track 5.21 (LTS)<\/strong><\/td>5.21.8 and earlier<\/td>5.21.9<\/td><\/tr>
Canonical LXD, track 5.0 (LTS)<\/strong><\/td>5.0.10 and earlier<\/td>5.0.11<\/td><\/tr>
Canonical LXD, track 4.0 (LTS)<\/strong><\/td>4.0.14 and earlier<\/td>4.0.15<\/td><\/tr>
Canonical MicroCloud, track 3<\/strong><\/td>Before 3.4.1<\/td>3.4.1<\/td><\/tr>
Canonical MicroCloud, track 2<\/strong><\/td>Before 2.1.5<\/td>2.1.5<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Only servers with the LXD HTTPS API enabled on the network are exposed, as is always the case in LXD clusters and in all MicroCloud installations.<\/p>\n\n

Description<\/h2>\n\n

A critical-severity vulnerability (CVSSv4 10.0 – CRITICAL) has been disclosed in Canonical LXD, Ubuntu’s container and virtual machine manager, and MicroCloud, the LXD-based private cloud solution. It allows an attacker without credentials who can reach the HTTPS API to authenticate as any trusted client. The vulnerability has been assigned CVE-2026-112816 and is an incorrect certificate validation issue (CWE-295).<\/p>\n\n

The flaw lies in the mutual TLS (mTLS) authentication of the remote API. The TLS handshake only proves that the client holds the private key of the first certificate in the chain, but LXD compared all certificates in the submitted chain against its trust list. An attacker who adds the public certificate of a trusted client as an intermediate certificate can impersonate that client without having its private key. Public certificates are not secrets: they are exchanged in TLS connections and can be obtained from any client machine.<\/p>\n\n

According to the vendor, depending on the privileges of the impersonated identity, the attacker may gain root access on the host, and the vulnerability record also indicates full access to the cluster and managed virtual machines. In MicroCloud, the attacker can intercept the public certificate of a member joining the cluster and then authenticate as that member.<\/p>\n\n

The vendor stated that the flaw was reported to them by researchers from an LXD-derived project that was also affected. According to those researchers, the issue has existed since the initial version of the code and there is no way to mitigate it through configuration.<\/p>\n\n

Exposure requires the HTTPS API to listen on the network (core.https_address<\/code> or cluster.https_address<\/code> configured). By default, LXD only listens on a local Unix socket, but the API is always exposed in LXD clusters, in MicroCloud, and on hosts managed remotely or through the web interface. The lxd<\/code> packages in supported Ubuntu releases are listed as unaffected or do not exist, since LXD has been distributed as a snap since Ubuntu 20.04.<\/p>\n\n

The vendor released the fixed versions on 29\/10\/2026 through a staged rollout from the candidate channel to the stable channel. The stable channels for LXD tracks 5.21, 5.0, and 4.0 only began serving the fixed versions on 01\/11\/2026 at 02:10 (PYT), so a snap refresh<\/code> performed before that time may not have installed the fix.<\/p>\n\n

No active exploitation has been reported, the vulnerability does not appear in the U.S. cybersecurity agency’s Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been identified. A government source assesses that exploitation can be automated and that the technical impact is total.<\/p>\n\n

Mitigation<\/h2>\n\n

The vendor has not published a temporary mitigation. While the update is being applied, it is recommended to:<\/p>\n\n