🔐 CVE Alert

CVE-2026-112816

UNKNOWN 0.0

Improper certificate validation in the HTTPS listener in LXD

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

CWE CWE-295
Vendor canonical
Product lxd
Ecosystems
Industries
Technology
Published Oct 30, 2026
Last Updated Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for canonical lxd

Be the first to know when new unknown vulnerabilities affecting canonical lxd are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Canonical / LXD
4.0.14 < 4.0.15 5.0.10 < 5.0.11 5.21.8 < 5.21.9 6.9.0 < 6.10.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4 discourse.ubuntu.com: https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557 discourse.ubuntu.com: https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024 discourse.ubuntu.com: https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1 discourse.ubuntu.com: https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1 discourse.ubuntu.com: https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571

Credits

🔍 Stéphane Graber