CVE-2026-112816criticalCWE-295

CVE-2026-112816: critical vulnerability in Canonical LXD

Improper certificate validation in the HTTPS listener in LXD

Published · Updated

Follow this CVE+ Monitor LXD+ Monitor lxd

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert and has a public proof of concept.

ssvc Attendcvss 10epss 0.3%
from disclosure to weapon1 day
Published on NVDOct 30
1st PoC+1d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Canonical · LXD
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Canonical LXD

In the same product, most dangerous first.

CVE-2026-63294CRITICALRoot RCE via image backup.yaml symlinkEPSS 0.9%CVE-2026-66897CRITICALInstance template path traversal allows arbitrary host file write as rootEPSS 0.7%CVE-2026-63298HIGHLXD arbitrary lxc.conf directive injection via NVIDIA instance configurationEPSS 0.7%CVE-2026-9640HIGHLXD Snapshot Import Privilege Escalation VulnerabilityEPSS 0.6%CVE-2025-54293HIGHPath Traversal in LXD Instance Log File RetrievalEPSS 0.6%CVE-2026-66898CRITICALPath traversal via unvalidated instance name in backup tarball restore enables root file write / RCEEPSS 0.6%