V4-10.0-Cvss - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/v4-10.0-cvss/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 18:40:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCanonical LXD and MicroCloud: Authentication bypass (CVE-2026-112816)https://feed.craftedsignal.io/briefs/2026-10-lxd-authentication-bypass/Sat, 31 Oct 2026 18:40:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lxd-authentication-bypass/An authentication bypass vulnerability (CVE-2026-112816) in the Canonical LXD HTTPS interface allows attackers to impersonate trusted clients via crafted TLS certificate chains, granting unauthorized control over clusters, containers, and host systems.CVE-2026-112816 is a critical vulnerability in the Canonical LXD HTTPS interface caused by improper validation of client TLS certificate chains. An attacker with network access to the LXD API can craft a certificate chain that mimics a trusted client, effectively bypassing authentication. This vulnerability impacts both LXD and MicroCloud environments. Canonical has released patches for multiple stable release tracks as of October 29, 2026.

Impact

Successful exploitation allows an unauthenticated attacker to gain control over the LXD/MicroCloud cluster, managed containers, virtual machines, and the underlying host system.

Recommendation

  1. Audit all systems running Canonical LXD or MicroCloud to identify versions currently below the minimum safe thresholds: LXD (4.0.15, 5.0.11, 5.21.9, 6.10.1) and MicroCloud (2.1.5, 3.4.1).
  2. Plan a maintenance window for patching, as snap refresh operations may restart services and cause temporary disruption to container or VM workloads.
  3. Restrict network access to the LXD HTTPS API to only authorized management subnets and trusted administrative clients using firewall or network security group policies.
  4. Perform post-patching validation by verifying package versions and ensuring cluster service health.
  5. Prior to patching, perform an investigation of LXD audit logs for signs of unauthorized API access or anomalous client certificate usage.
]]>criticaladvisoryauthentication-bypassv4-10.0-cvsslxdmicrocloudvulnerability