Canonical has fixed a critical flaw in its LXD container and virtual-machine manager and in MicroCloud that lets an attacker pose as a trusted client without holding that client's private key. The flaw, tracked as CVE-2026-112816, carries the maximum CVSS score of 10.0 and comes from improper certificate validation in LXD's HTTPS listener.

An attacker who can reach the LXD HTTPS API over the network and who holds the trusted client's public certificate can authenticate as that client, Canonical's advisory says, gaining full access to the cluster and the virtual machines it manages. In MicroCloud, an attacker can intercept the public TLS certificate of a joining cluster member and then authenticate as that member. The issue was reported to Canonical by the Incus project, which began as a community fork of LXD, and Incus fixed the same flaw in version 7.6.0.

Fixed versions to install

Canonical's fixed snap releases, dated 29 October 2026, are LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5. Snap users should run "sudo snap refresh lxd" and "sudo snap refresh microcloud", then check the installed version, because Canonical said the point releases were still rolling out progressively from the candidate channel to stable when the advisory was issued.

No known exploitation, no workaround

There is no public sign the flaw has been used in an attack: the CVE record carries a US CISA assessment dated 30 October that it is not known to have been exploited, and it is not on CISA's Known Exploited Vulnerabilities list. Canonical gives no temporary workaround for LXD, so limiting who can reach the HTTPS API reduces risk until the update is installed. Ubuntu's own archive packages of LXD are listed as not affected or not shipped, so the fixed releases are the snaps.