Skip to content
Critical CVE-2026-112816 Flaw in Canonical's LXD and MicroCloud Allows Client Impersonation

Critical CVE-2026-112816 Flaw in Canonical's LXD and MicroCloud Allows Client Impersonation

First seen 1 Nov 2026, 14:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 1, 2026 at 16:15 UTC
  • •CVE-2026-112816 is rated 10.0 on the CVSS scale, indicating critical severity.
  • •Attackers can impersonate trusted clients by exploiting improper certificate validation.
  • •Canonical has released fixes, and no known exploitation has been reported.

A critical vulnerability in Canonical's LXD and MicroCloud products allows attackers to impersonate trusted clients without needing their private keys. This flaw, tracked as CVE-2026-112816 and rated with a CVSS score of 10.0, affects versions 4.0.14, 5.0.10, 5.21.8, and 6.9. The vulnerability arises from improper certificate validation during mutual TLS authentication, enabling attackers to present a crafted certificate chain that includes a trusted client's public certificate. Exploitation requires network access to the HTTPS API and possession of the trusted client's public certificate. Canonical has released fixed versions of both products, and there are no known instances of exploitation as of now. Users are advised to update to the latest snap releases to mitigate the risk.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
CVE-2026-112816 published
Canonical disclosed a critical vulnerability affecting LXD and MicroCloud, allowing client impersonation.
Thehackernews
2026-11-01
Patch released
Canonical released fixed versions of LXD and MicroCloud to address the critical flaw.
News.Lavx.Hu

More articles in this cluster (8)

Following this threat?

Track Ubuntu and CVE-2026-112816 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which versions of LXD and MicroCloud are affected?
Affected versions include LXD 4.0.14, 5.0.10, 5.21.8, and 6.9, prior to the fixed releases.
Has this vulnerability been exploited in the wild?
No, there are currently no known instances of exploitation for this vulnerability.
What steps should I take to mitigate this vulnerability?
Update to the fixed snap releases of LXD and MicroCloud as soon as possible.