Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2026-112816 EUVD-2026-114194GHSA-pq55-m3w3-jh54

Improper certificate validation in the HTTPS listener in LXD

Published Oct 30, 2026 · Updated Oct 31, 2026 · Assigned by canonical

Vendor: Canonical Product: LXD Package: lxd Ecosystem: Debian

Description

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Affected products

VendorProductAffectedFixed
Canonical LXD 4.0.14 – < 4.0.15, 5.0.10 – < 5.0.11, 5.21.8 – < 5.21.9, 6.9.0 – < 6.10.1 4.0.15

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 lxd No fix yet —
Debian 12 lxd No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • dehasoft-tr/cve-2026-112816 ★ 4 · Oct 31, 2026
  • MrNarsus/cve-2026-112816-poc ★ 3 · Nov 1, 2026

    Independent lab reproduction and post-patch verification tool for CVE-2026-112816 (LXD/MicroCloud mTLS chain bypass).

  • foxcornlab/lxd-scanner ★ 0 · Nov 2, 2026

    Detection-only local triage scanner for CVE-2026-112816 (CVSS 10.0) in Canonical LXD and MicroCloud: grades LXD, MicroCloud and Incus versions against the fixed builds, catches the 6.10.0 trap. No pa…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References