CVE-2026-112816: Remote API mutual-TLS client authentication (certificate chain matching)
LXD and MicroCloud compared every certificate in a client's TLS chain against the trust store, but only the leaf proves possession of the private key. An attacker with a trusted client's public certificate can authenticate as that identity, and MicroCloud joiners can be impersonated by intercepting their certificate. Depending on the victim's privileges, this can lead to root on the host. The issue was reported via the Incus project.
Executive Summary & Technical Impact
LXD and MicroCloud compared every certificate in a client's TLS chain against the trust store, but only the leaf proves possession of the private key. An attacker with a trusted client's public certificate can authenticate as that identity, and MicroCloud joiners can be impersonated by intercepting their certificate. Depending on the victim's privileges, this can lead to root on the host. The issue was reported via the Incus project.
Tracked under CVE-2026-112816 (CWE-295 (Improper Certificate Validation)), this vulnerability affects LXD snaps 4.0.14, 5.0.10, 5.21.8, 6.9.0 and later before the fixed releases; MicroCloud 2.x/3.x before 2.1.5 / 3.4.1 and carries a severity score of 10.0 (CVSS 4.0, Canonical) (CRITICAL). Engineering and security operations teams running LXD; MicroCloud (snaps) should prioritize upgrading to LXD 6.10.1, 5.21.9, 5.0.11, 4.0.15; MicroCloud 3.4.1, 2.1.5 (released 2026-10-29).
Remediation & Patch Guidance
- Run sudo snap refresh lxd and sudo snap refresh microcloud, then confirm the fixed version with snap list (rollout is progressive).
- Restrict network access to the LXD API. Standalone LXD is only exposed if core.https_address is set.
- Review trusted clients with lxc config trust list and remove any you don't recognize.
Frequently Asked Questions (CVE-2026-112816)
What versions are affected by CVE-2026-112816?
CVE-2026-112816 affects LXD snaps 4.0.14, 5.0.10, 5.21.8, 6.9.0 and later before the fixed releases; MicroCloud 2.x/3.x before 2.1.5 / 3.4.1 in LXD; MicroCloud (snaps) (Remote API mutual-TLS client authentication (certificate chain matching)).
How do I patch or remediate CVE-2026-112816?
Upgrade affected deployments to LXD 6.10.1, 5.21.9, 5.0.11, 4.0.15; MicroCloud 3.4.1, 2.1.5 (released 2026-10-29) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-112816?
CVE-2026-112816 is rated CRITICAL with a CVSS score of 10.0 (CVSS 4.0, Canonical) (vector: Network; attacker who can reach the LXD/MicroCloud HTTPS API and knows a trusted client's public certificate places it as an intermediate in the chain).
Two Critical Bugs in Dev Infrastructure Control Planes: LXD/MicroCloud CVE-2026-112816 and pgAdmin CVE-2026-116241
A CVSS 10.0 mTLS certificate-chain flaw lets attackers impersonate trusted LXD clients and MicroCloud members, and a CVSS 9.9 pgAdmin import/export injection hands low-privilege users OS command execution. Both were fixed on October 29.
Read full engineering post-mortem (6 min read) →