CVE-2026-112816

Improper certificate validation in the HTTPS listener in LXD

No known exploitation. EPSS puts it in the 23rd percentile. Fixed versions are out.

CVSS —Not scored EPSS percentile23rd0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1 product4 fixed builds listed below

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-10-30Updated 2026-10-31Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Canonical LXDAffected: ≥ 4.0.14, < 4.0.15Upgrade to: 4.0.15Affected: ≥ 5.0.10, < 5.0.11Upgrade to: 5.0.11Affected: ≥ 5.21.8, < 5.21.9Upgrade to: 5.21.9Affected: ≥ 6.9.0, < 6.10.1Upgrade to: 6.10.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which LXD version your team is running (lxc version or ask your admin).
If running 4.0.14, 5.0.10, 5.21.8, 6.9, or earlier in those branches, plan an upgrade.
Upgrade to the fixed version for your branch: 4.0.15, 5.0.11, 5.21.9, or 6.10.1.
After upgrading, confirm the HTTPS listener is working normally and trusted clients can still authenticate.

Usually a quick update

What it is

From the CVE record

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

In plain language

Written by AI from the record

A flaw in LXD's HTTPS listener could let someone impersonate a trusted client using a fake certificate, but it hasn't been seen exploited and there's a free fix available (upgrade to 4.0.15, 5.0.11, 5.21.9, or 6.10.1) so this is a routine patch, not an emergency.

Improper certificate chain validation in LXD's HTTPS listener (CWE-295) allows an unauthenticated attacker with a crafted certificate chain to be authenticated as any already-trusted client, gaining full cluster and VM access.

If you're affected

Full cluster takeover
Unauthorized VM access
Data exposure on hosted VMs
Operational disruption

What is it

LXD is software that manages virtual machines and containers, and it uses digital certificates like ID badges to decide who's allowed in. This bug means a cleverly forged ID badge could trick the system into granting the same access as a legitimate, trusted user — potentially full control over everything LXD manages.

Who is affected

This matters to you if your business runs Canonical LXD to manage virtual machines or containers, particularly if the HTTPS management listener is exposed to a network attackers can reach. It does not require the attacker to have any existing login — they only need to reach the listener and present a crafted certificate.

How urgent is it

There is no evidence of active exploitation, no listing in CISA's known-exploited-vulnerabilities catalog, and no public exploit code available, so this does not require emergency action. Apply the fix during your normal patching cycle to close the gap before it becomes a higher-priority issue.

What to do — in detail

Identify all LXD deployments and their exact version (lxc version, or snap info lxd if installed via snap). 2. Determine which branch you're on (4.0.x, 5.0.x, 5.21.x, or 6.x) and target the fixed release for that branch: 4.0.15, 5.0.11, 5.21.9, or 6.10.1. 3. If upgrading across major branches (e.g., 5.21.x → 6.10.1), review Canonical's release notes for breaking changes before proceeding, especially around clustering and storage drivers. 4. If immediate patching isn't possible, restrict network access to the LXD HTTPS listener (firewall rules, VPN-only access) to reduce exposure until upgraded — this is a temporary mitigation, not a fix. 5. No CISA KEV deadline applies since this CVE is not in the KEV catalog. 6. After patching, monitor authentication logs on the LXD API for unexpected trusted-client logins from unfamiliar certificate chains or IPs.

Technical context

CWE-295 (Improper Certificate Validation) in LXD's HTTPS listener allows an unauthenticated attacker to construct a crafted certificate chain that is accepted as belonging to an already-trusted client, bypassing mutual TLS trust checks and granting full cluster/VM access. Not present in CISA's KEV catalog, no public exploit code identified, and EPSS places predicted exploitation likelihood in the low range with a flat trend — consistent with no observed in-the-wild activity. Fixed in 4.0.15, 5.0.11, 5.21.9, and 6.10.1; attack vector is network-based against the HTTPS management interface, requiring no prior authentication.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.