CVSS 10.0 LXD, Micro Cloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

Summary: A critical flaw in Canonical's LXD and MicroCloud, tracked as CVE-2026-112816 with a maximum CVSS score of 10.0, let an attacker log in as a trusted client without that client's private key by attaching the trusted client's public certificate behind their own in the TLS chain, since the server checked every certificate against its trust store but TLS only proves ownership of the leaf. Canonical has released fixed versions, the flaw was reported by the Incus project and fixed there in 7.6.0, and the CVE record carries a CISA assessment dated October 30 that it is not known to have been exploited.
Why it matters: Exploitation needs only two things - network access to the HTTPS API and a trusted client's public certificate, which is not secret - so any MicroCloud cluster where an attacker can capture a member's certificate as it joins is exposed, and Canonical's advisory offers no temporary workaround for LXD.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-112816
Related: ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026