Canonical said in a security advisory that a critical flaw affects LXD and MicroCloud, its tools for running virtual machines and clusters. An attacker who can reach the HTTPS API can sign in as any trusted client whose public certificate they hold. The Hacker News reported that the flaw is tracked as CVE-2026-112816 and has the top CVSS score of 10.0. Canonical released fixes on 2026-10-29: LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 2.1.5 and 3.4.1.
Canonical said the server checked every certificate a client sent against its trusted list. Only the first certificate proves the client holds the private key. In MicroCloud, an attacker who intercepts a joining member's public certificate can then act as that member. The Hacker News said a standalone LXD server does not open this API by default. It also said a CISA assessment dated October 30 lists no known exploitation, and no working exploit is public. Canonical said LXD point releases were still rolling out from candidate to stable. Its advisory names no workaround.
Canonical said the attacker may gain root access to the host, depending on the victim's privileges. Public certificates are not secret, so teams cannot count on hiding them. Anyone running either product should update and then check the installed version. The Hacker News said limiting who can reach the API lowers risk until then.