Vulnerability Description
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Related Weaknesses (CWE)
References
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in
- https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4
FAQ
What is CVE-2026-112816?
CVE-2026-112816 is a documented vulnerability. Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trust...
How severe is CVE-2026-112816?
CVSS scoring is not yet available for CVE-2026-112816. Check NVD for updates.
Is there a patch for CVE-2026-112816?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.