Skip to content
Threat Feed
Subscribe
critical advisory

Canonical LXD and MicroCloud: Authentication bypass (CVE-2026-112816)

An authentication bypass vulnerability (CVE-2026-112816) in the Canonical LXD HTTPS interface allows attackers to impersonate trusted clients via crafted TLS certificate chains, granting unauthorized control over clusters, containers, and host systems.

CVE search metadata

CVE search record: CVE-2026-112816. KEV: no. Product: LXD (< 4.0.15/5.0.11/5.21.9/6.10.1), MicroCloud (< 2.1.5/3.4.1). Brief: Canonical LXD and MicroCloud: Authentication bypass (CVE-2026-112816). Brief link: https://feed.craftedsignal.io/briefs/2026-10-lxd-authentication-bypass/

Triage facts

Revision 1
Applicability
LXD (< 4.0.15/5.0.11/5.21.9/6.10.1), MicroCloud (< 2.1.5/3.4.1)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 31, 18:40 UTC
Vulnerabilities
1 CVE
Source quality
B2Very likely

CVE-2026-112816 is a critical vulnerability in the Canonical LXD HTTPS interface caused by improper validation of client TLS certificate chains. An attacker with network access to the LXD API can craft a certificate chain that mimics a trusted client, effectively bypassing authentication. This vulnerability impacts both LXD and MicroCloud environments. Canonical has released patches for multiple stable release tracks as of October 29, 2026.

Impact

Successful exploitation allows an unauthenticated attacker to gain control over the LXD/MicroCloud cluster, managed containers, virtual machines, and the underlying host system.

Recommendation

  1. Audit all systems running Canonical LXD or MicroCloud to identify versions currently below the minimum safe thresholds: LXD (4.0.15, 5.0.11, 5.21.9, 6.10.1) and MicroCloud (2.1.5, 3.4.1).
  2. Plan a maintenance window for patching, as snap refresh operations may restart services and cause temporary disruption to container or VM workloads.
  3. Restrict network access to the LXD HTTPS API to only authorized management subnets and trusted administrative clients using firewall or network security group policies.
  4. Perform post-patching validation by verifying package versions and ensuring cluster service health.
  5. Prior to patching, perform an investigation of LXD audit logs for signs of unauthorized API access or anomalous client certificate usage.

Immediate actions

Identify all hosts running vulnerable versions of LXD/MicroCloud and schedule emergency maintenance

IT Operations 24h

Threat Hunt

Analyze LXD audit logs for unexpected or anomalous client certificate connection requests to the API

T1190 high high confidence hunt now

Data: LXD daemon logs, LXD API audit logs

Mitigations

Update LXD to 6.10.1 (or other track-specific safe versions) and MicroCloud to 3.4.1

immediate IT Operations

CVE-2026-112816

Gaps

  • Lack of specific SIEM correlation rule for this authentication bypass pattern