Canonical LXD: Improper certificate validation allows cluster access
Summary
Improper certificate validation in the HTTPS listener of Canonical LXD allows an attacker who can reach the HTTPS API to authenticate as any trusted client. The attacker needs the public certificate of a trusted client, which does not have to be secret. A successful attack grants full access to the LXD cluster and the managed virtual machines, and depending on the impersonated user's privileges, root on the host. The CVE record gives a CVSS v4.0 score of 10.0 (Critical).
Affected
- Canonical LXD 4.0.14 up to 4.0.15 (exclusive)
- Canonical LXD 5.0.10 up to 5.0.11 (exclusive)
- Canonical LXD 5.21.8 up to 5.21.9 (exclusive)
- Canonical LXD 6.9.0 up to 6.10.1 (exclusive)
- MicroCloud, which is built on LXD, is reported to be affected as well
- The CVE record marks the default configuration as unaffected. The HTTPS API must be reachable for the attack.
Fixed in
- LXD 4.0.15
- LXD 5.0.11
- LXD 5.21.9
- LXD 6.10.1
- Ubuntu stable channels received the fixed builds on 29 Oct 2026.
Workaround
Unknown. No vendor workaround is documented in the sources. Restricting access to the LXD HTTPS API port with a firewall reduces exposure until the update is applied; this is a recommendation, not a vendor instruction.
Exploitation
- CISA SSVC: exploitation none, automatable yes, total technical impact.
- No evidence of exploitation or public exploit found at the time of writing.
- Not listed in CISA KEV according to OffSeq.
- The record is less than one day old.
Our recommendation
- Inventory all LXD and MicroCloud installations and their exact versions.
- Update to the fixed versions listed above without delay.
- Restrict access to the LXD HTTPS API to trusted networks only.
- Review which client certificates are trusted and check logs for unexpected client certificate use.
- Monitor the vendor advisory for further updates.
Research sources
- Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud discourse.ubuntu.com
- GitHub Security Advisory GHSA-99jp-jwmc-65p4 github.com
- LXD 4.0.15 LTS has been released discourse.ubuntu.com
- LXD 5.0.11 LTS has been released discourse.ubuntu.com
- LXD 5.21.9 LTS has been released discourse.ubuntu.com
- LXD 6.10.1 LTS has been released discourse.ubuntu.com
- CVE-2026-112816 OffSeq Radar radar.offseq.com
- LXD security documentation canonical.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:21.
Original description (NVD)
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
NVD references (6)
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud…
- https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.