LXD and Incus Flaw Puts Linux Hosts at Risk

A newly discovered flaw in the certificate validation process of LXD and Incus could enable remote attackers to bypass authentication and gain control over clusters and virtual machines on Linux systems.

Details of the Vulnerability

This vulnerability affects the HTTPS management interface, exposing Linux hosts to potential attacks that require no password or user interaction. Incus has rated this flaw as critical, assigning it a CVSS score of 10.0. Canonical, on October 30, identified the related LXD vulnerability as CVE-2026-112816, categorizing it as Medium priority but acknowledging the risk of unauthorized access.

Understanding the Certificate Validation Flaw

The origin of the problem lies in the service’s handling of certificates during an HTTPS connection. The TLS handshake process verifies that the client possesses the private key for the first certificate. However, subsequent certificates in the chain, controlled by the client, are not verified, leading to potential security gaps. An attacker could exploit this by adding a public part of a trusted certificate to their chain, misleadingly presenting themselves as its legitimate owner.

Such public certificates are easily accessible as servers share them during TLS handshakes. As a result, attackers could gain internal cluster access or database gateway access without needing an account. This vulnerability is distinct from container escape issues because it targets the management layer controlling environment access.

Mitigation and Recommendations

Incus has identified versions prior to 7.6.0 as vulnerable, with version 7.6.0 and later being secure. Canonical has provided fixes for affected LXD versions, including 4.0.15, 5.0.11, 5.21.9, and 6.10.1. It is crucial for administrators to update to these versions to ensure security.

Until patches are applied, restricting HTTPS listener access to trusted hosts is recommended. However, this is not a substitute for updating the software, as network restrictions alone cannot correct the underlying validation flaw.

Importance of Timely Updates

The advisories have not yet reported any active exploitation, meaning there is still an opportunity to patch systems before any potential breaches occur. As the landscape of cyber threats evolves, with AI making attacks more efficient, maintaining up-to-date defenses is increasingly critical.