Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by canonical

CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD

Critical 10.0

In plain English

A critical-severity improper certificate validation in LXD from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)0.3%top 76.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lxdno fix listedDEBIAN-CVE-2026-112816
Debian:13lxdno fix listedDEBIAN-CVE-2026-112816

Affected products (as reported)

VendorProductVersions
Canonical LXD 4.0.14 – before 4.0.155.0.10 – before 5.0.115.21.8 – before 5.21.96.9.0 – before 6.10.1

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References