A critical security flaw in Canonical LXD and MicroCloud allows unauthorized attackers to impersonate trusted clients and gain administrative control over host machines, according to a recent report by The Hacker News.
The vulnerability, tracked as CVE-2026-112816, carries a maximum CVSS score of 10.0. It stems from improper certificate validation during mutual TLS authentication. Attackers can exploit this by attaching a trusted client's public certificate to their own connection chain, tricking the server into granting access without the corresponding private key. If the impersonated account possesses elevated privileges, an attacker could achieve root access to the host machine.
While standalone LXD servers are generally protected unless the network API is manually enabled, MicroCloud clusters face higher risks due to their interconnected nature. The flaw was identified by the Incus project, which also released a fix in version 7.6.0. Canonical has since provided updated snap versions for LXD and MicroCloud to address the issue. Although there is no evidence of active exploitation, administrators are urged to update their software immediately by running the snap refresh command. Restricting network access to the API remains the only viable mitigation for those unable to patch their systems immediately.
Source: The Hacker News
