CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

Canonical has patched a maximum-severity flaw, CVE-2026-112816, affecting LXD and MicroCloud that allowed an attacker to authenticate as a trusted client without ever possessing that client's private key. The bug stemmed from a flawed server-side certificate check in the mutual-TLS setup: the server validated every certificate in a client's submitted chain against its trust store, even though only the leaf certificate's key ownership is actually proven during the TLS handshake. As a result, anyone who obtained a trusted client's public certificate—not a secret value—could attach it behind their own certificate and get accepted as that trusted identity, potentially gaining root access to the host if the impersonated account had elevated privileges. The flaw hits LXD versions 4.0.14, 5.0.10, 5.21.8 and 6.9, plus MicroCloud, and is fixed in the snap releases 4.0.15, 5.0.11, 5.21.9, 6.10.1 for LXD and 2.1.5/3.4.1 for MicroCloud; the related Incus fork patched the same issue in version 7.6.0. No exploitation in the wild has been observed, but administrators are urged to run snap refresh for both lxd and microcloud and to restrict network access to the HTTPS API in the meantime.