Critical CVE-2026-112816 Affects Canonical LXD with 10.0 CVSS Score

## Overview CVE-2026-112816 affects Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9. The vulnerability arises from improper certificate validation in the HTTPS listener. This flaw allows unauthenticated attackers to authenticate as any trusted client. ## Technical Details The issue lies in how LXD handles certificate chains. An attacker can exploit this flaw by presenting a crafted certificate chain. If successful, the attacker gains full access to the cluster and managed virtual machines. The affected versions include: - 4.0.14 - 5.0.10 - 5.21.8 - 6.9 The fixed versions are 4.0.15, 5.0.11, 5.21.9, and 6.10.1. The vulnerability has a CVSS score of 10.0, indicating critical severity. ## Impact Successful exploitation of this vulnerability can lead to unauthorized access to sensitive resources. Attackers can manipulate virtual machines and potentially disrupt services. The risk is significant, especially for environments relying on LXD for container management. ## Mitigation Defenders must update to the patched versions of Canonical LXD immediately. Ensure that systems are running either 4.0.15, 5.0.11, 5.21.9, or 6.10.1. Regularly audit certificate validation processes to prevent similar vulnerabilities in the future. Additionally, monitor access logs for any unusual activity that may indicate exploitation attempts.