Short answer: A critical security flaw in LXD and MicroCloud allows attackers to impersonate trusted clients without needing a private key. Update to the latest versions to fix it.
TL;DR
- LXD and MicroCloud versions affected
- Attackers can impersonate trusted clients
- Update to fixed versions
- Limit network access to HTTPS API
What is CVE-2026-112816?
This issue is a security vulnerability in LXD and MicroCloud, software used for managing virtual machines. Attackers can impersonate trusted clients by forging certificates. This lets them gain full access to the cluster and virtual machines. To fix, update to the latest versions or restrict network access to the LXD API.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- CVSS score
- A 0 to 10 rating of how dangerous a weakness is. 9 or more is critical.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 01 Nov 2026 |
| CVE | CVE-2026-112816 |
| CVSS | 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-295 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
How it works
An attacker can impersonate a trusted client on Canonical's LXD and MicroCloud by adding a trusted public certificate to their own certificate chain. The server accepts the attacker as the trusted client, giving them full access to the cluster and virtual machines.
- Attacker reaches the attackers over the internet / network
- No login or account is needed
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-10-30 | CVE-2026-112816 published in NVD | NVD |
| 2026-11-01 | Reported by The Hacker News | The Hacker News |
| 2026-11-01 | This Skillmate explainer published | Skillmate |
How to fix it
- If you cannot patch today, limit who can reach the affected service and watch its logs.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-112816 is a real NVD record scored 10.0 CRITICAL | CISA KEV does not list CVE-2026-112816 as exploited in the wild |
| Reported by The Hacker News | NVD links no vendor advisory for CVE-2026-112816 yet |
| Reported by discourse.ubuntu.com | |
| Reported by github.com |
Why it matters
This flaw allows attackers to gain unauthorized access, posing a significant risk to companies and users. It highlights the importance of secure authentication practices and regular software updates.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What does CVE-2026-112816 mean?
CVE-2026-112816 is a security flaw in LXD and MicroCloud that allows attackers to impersonate trusted clients without needing a private key.
How can I protect my system from this flaw?
Update to the latest versions of LXD and MicroCloud. Restrict network access to the HTTPS API to trusted hosts.
What is mutual TLS?
Mutual TLS is a security protocol where both the client and server verify each other’s identities using digital certificates.
What versions are affected?
Versions 4.0.14, 5.0.10, 5.21.8, and 6.9 of LXD and 2.1.5 and 3.4.1 of MicroCloud are affected. Update to 4.0.15, 5.0.11, 5.21.9, and 6.10.1.
Related Skillmate posts
Sources
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key (The Hacker News)
- Primary source / advisory (discourse.ubuntu.com)
- Primary source / advisory (github.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
