Canonical has identified a severe security vulnerability in its LXD and MicroCloud products, potentially allowing unauthorized access to trusted client accounts. This flaw, marked as CVE-2026-112816, holds a critical CVSS score of 10.0. The vulnerability permits attackers to impersonate a trusted client without possessing the private key, thereby gaining access to sensitive systems.
Understanding the Vulnerability
The security issue lies in the handling of client certificates by LXD and MicroCloud when connecting over mutual TLS. Typically, clients prove their identity by presenting a certificate stored in the server’s trust store. However, the server’s method of certificate validation was flawed. It only ensured the client owned the private key for the first certificate in the chain, allowing attackers to append a trusted public certificate to their own chain and gain unauthorized access.
Impact on Systems and Users
Exploiting this vulnerability requires network access to the HTTPS API and possession of a trusted client’s public certificate. While standalone LXD servers don’t expose APIs by default, configurations enabling network API access can be vulnerable. MicroCloud clusters, which consolidate several LXD machines, are particularly at risk. Attackers capturing a cluster member’s public certificate can then exploit the system as that member.
Canonical has identified affected versions as LXD 4.0.14, 5.0.10, 5.21.8, and 6.9, and has released updates to address the issue. The fixed versions include LXD 6.10.1, 5.21.9, 5.0.11, and 4.0.15, along with MicroCloud 3.4.1 and 2.1.5.
Actions and Recommendations
It is crucial for users to update their LXD and MicroCloud installations to the fixed versions immediately. For snap installations, the commands sudo snap refresh lxd and sudo snap refresh microcloud should be used to apply updates. Canonical advises verifying the version post-update to ensure the fix is applied.
Restricting network access to the API until updates are completed can mitigate risks. The Incus project, which initially identified the flaw, recommends users move to version 7.6.0, as it addresses this and other security concerns.
Although there is no evidence of the flaw being exploited in the wild, it remains imperative to address this vulnerability swiftly to safeguard systems from potential attacks.
