A maximum-severity bug in Canonical's container and private-cloud platforms let an attacker pose as a trusted client without ever holding its private key.
The Hacker News reports that Canonical's LXD and MicroCloud contained a flaw, tracked as CVE-2026-112816 with a maximum CVSS score of 10.0, that let an attacker act as a trusted client without its private key. The server checked client certificates against its trust store but only verified possession of the leaf certificate, so an attacker could attach a trusted client's public certificate to their own certificate chain. Exploitation needs network access to the HTTPS API, which a standalone LXD server does not expose by default unless an administrator turns on the core.https_address setting; for MicroCloud, capturing a member's public certificate as it joins the cluster is enough to log in as that member.
The Incus project reported the bug and fixed it in version 7.6.0. Canonical has released fixed versions of both products, LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5, though it said the LXD point releases were still rolling out to stable at the time of its advisory. CISA's assessment, dated October 30, found no sign the flaw has been exploited, and it is not on the Known Exploited Vulnerabilities catalog.
Why it matters: LXD and MicroCloud underpin private-cloud and container deployments where trust between nodes is assumed by design, so a certificate-impersonation flaw like this one undercuts that trust model directly. Even with no known exploitation yet, enterprises running either product should patch promptly and restrict network access to the management API in the meantime.