CVE-2026-112816
Real vuln, patched promptly, no PoC/KEV yet; early chatter is advisory rehashing.
What: Improper certificate validation in Canonical LXD HTTPS listener (versions 4.0.14, 5.0.10, 5.21.8, 6.9 and earlier) allows unauthenticated attackers to forge client certificates and gain full cluster/VM access.
Why it matters: Published 2026-10-30; affects widely-deployed container/VM orchestration tool. Social chatter claims CVSS 10.0 (NVD lists n/a). Not yet KEV-listed. Canonical has issued patched versions (4.0.15, 5.0.11, 5.21.9, 6.10.1). No public PoC or in-the-wild reports confirmed in posts; chatter is primarily vendor advisory amplification and CVE database replication.
Where it's seen: Social media repeating NVD description and patch guidance same-day; no defender triage reports, no technical deep-dives, no exploitation signals—typical early-stage coordinated disclosure pattern.
RISK: HIGH — Critical auth bypass in infrastructure orchestration; patch available; adoption uncertainty unknown.
Description
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Weaknesses
References
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557
- https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4