CVE-2026-112816
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8…
- Risk score
- 65/100
- CVSS
- 10.0 v4.0
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Canonical LXD has a vulnerability in its HTTPS listener that allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
- Affected
- {'products': ['Canonical LXD'], 'packages': [], 'versions': ['4.0.14', '5.0.10', '5.21.8', '6.9 before 4.0.15', '5.0.11', '5.21.9', '6.10.1']}
- Fix
- Upgrade to versions 4.0.15, 5.0.11, 5.21.9, 6.10.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557
- https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4
Original description
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Last activity 30 Oct 2026. Patch Forecast updates every hour.