Critical LXD and MicroCloud TLS Authentication Bypass Enables Client Impersonation

Canonical has patched CVE-2026-112816, a critical authentication bypass in LXD and MicroCloud that also affects Incus and carries a reported CVSS score of 10.0. An attacker who can reach the HTTPS API and obtain a trusted client's public certificate can impersonate that client without its private key. The API incorrectly compares every certificate in a client-supplied TLS chain against its trust store, although only the leaf certificate establishes private-key possession. Placing a trusted public certificate elsewhere in the chain can therefore bypass authentication. Successful impersonation can expose cluster and virtual-machine resources and, depending on the victim's privileges, grant root access to the host. In MicroCloud, attackers may obtain the required public certificate by intercepting it during a member's cluster-joining process.

Administrators should update immediately to fixed releases in their deployment channels: LXD 6.10.1, 5.21.9, 5.0.11, or 4.0.15; and MicroCloud 2.1.5 or 3.4.1. Fixed Incus releases are also available. Restricting HTTPS API access to necessary, trusted networks reduces exposure while updates are deployed but does not remediate the flaw. The November 1 reporting cited no known exploitation or published working exploit, consistent with an October 30 CISA assessment that exploitation was not known.