CRITICAL 10.0 NVD
CVE-2026-112816
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticat
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
References
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-10-30 via NVD.
Risk Timeline
CVE Disclosed2026-10-30 · -1 days ago
Remediation Resources
Official Advisory
discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571Official Advisory
discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.