Critical CVE-2026-112816 Affects Canonical LXD, Requires Immediate Action

## Overview CVE-2026-112816 is a critical vulnerability affecting Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9 prior to their respective patched versions. This flaw involves improper certificate validation in the HTTPS listener of LXD. An unauthenticated attacker can exploit this weakness to authenticate as any trusted client. ## Technical Details The vulnerability arises from the way Canonical LXD validates certificates. Attackers can craft a malicious certificate chain that bypasses the validation checks. This allows them to gain full access to the LXD cluster and the managed virtual machines. The affected versions include: - 4.0.14 - 5.0.10 - 5.21.8 - 6.9 (before 4.0.15, 5.0.11, 5.21.9, 6.10.1) ## Impact Successful exploitation of CVE-2026-112816 can lead to unauthorized access to sensitive data and control over virtual machines within the cluster. An attacker could manipulate or disrupt services, posing a severe risk to the integrity and confidentiality of the environment. ## Mitigation Defenders should upgrade to the following patched versions to mitigate this vulnerability: - 4.0.15 or later - 5.0.11 or later - 5.21.9 or later - 6.10.1 or later Immediate action is necessary to protect against potential exploitation of this critical flaw.