CVE-2026-112816 Improper certificate validation in the HTTPS listener in LXD
CriticalCVSS 10.0
EPSS 0.30%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Canonical LXD | >= 4.0.14, < 4.0.15 | 4.0.15 |
| Canonical LXD | >= 5.0.10, < 5.0.11 | 5.0.11 |
| Canonical LXD | >= 5.21.8, < 5.21.9 | 5.21.9 |
| Canonical LXD | >= 6.9.0, < 6.10.1 | 6.10.1 |
| debian/lxd(Debian:12) | All versions | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-1 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-2 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-3 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-4 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-5 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-6 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-7 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-8 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2+git20231211.1364ae4-9 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5+deb12u1 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5+deb12u2 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5+deb12u3 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5+deb12u4 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5+deb12u5 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-5+deb12u6 | No fix listed |
| debian/lxd(Debian:12) | = 5.0.2-6 | No fix listed |
| debian/lxd(Debian:13) | All versions | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9 | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u1 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u2 | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u3 | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u4 | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u5 | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u6 | No fix listed |
| debian/lxd(Debian:13) | = 5.0.2+git20231211.1364ae4-9+deb13u7 | No fix listed |
References
- github.com vendor-advisory
- discourse.ubuntu.com vendor-advisory
- discourse.ubuntu.com release-notes
- discourse.ubuntu.com release-notes
- discourse.ubuntu.com release-notes
- discourse.ubuntu.com release-notes
- Debian Security Tracker CVE-2026-112816 vendor-advisory