CVE-2026-112816 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-112816 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-112816 is a critical authentication bypass in Canonical LXD’s HTTPS listener. Affected versions of LXD can improperly validate certificate chains, allowing an unauthenticated attacker to present a crafted certificate chain and be accepted as any trusted client. In practice, that can mean full access to the LXD cluster and all managed virtual machines.

For solo developers and small teams, this is a high-priority infrastructure issue: if your LXD endpoint is reachable from any untrusted network, treat it as exposed until proven otherwise. Even though there is no known exploitation in the wild and it is not in CISA KEV, the severity is CRITICAL (CVSS 10) and the blast radius is severe.

Immediate Action

  • Upgrade LXD immediately to a fixed release: 4.0.15, 5.0.11, 5.21.9, or 6.10.1 (or later).
  • Temporarily isolate the HTTPS listener from untrusted networks. Restrict access at the firewall/security group level to only trusted admin IPs.
  • Disable public exposure of the LXD API if you do not need remote cluster management right now.
  • Rotate any credentials, certificates, or trust relationships used to administer LXD after patching, especially if the service was internet-reachable.
  • Review logs for unexpected client certificates or admin actions around the LXD API endpoint.
  • Check the vendor advisory and release notes: Canonical LXD security advisory.

Affected Versions

  • lxd@4.0.14 vulnerable; upgrade to 4.0.15+
  • lxd@5.0.10 vulnerable; upgrade to 5.0.11+
  • lxd@5.21.8 vulnerable; upgrade to 5.21.9+
  • lxd@6.9 vulnerable; upgrade to 6.10.1+

If you run LXD via distro packages or containers, confirm the packaged version matches one of the fixed releases above. If your environment uses a backported security patch, verify the vendor changelog before assuming safety.

Resolution Guide

Linux package upgrade

# Ubuntu/Debian
sudo apt update
sudo apt install --only-upgrade lxd

# RHEL/CentOS/Fedora (if packaged)
sudo yum update lxd
# or
sudo dnf update lxd

If you deploy LXD in a container or appliance

# Pull a fixed image tag (example placeholders)
docker pull TODO_REGISTRY/lxd:4.0.15
docker pull TODO_REGISTRY/lxd:5.0.11
docker pull TODO_REGISTRY/lxd:5.21.9
docker pull TODO_REGISTRY/lxd:6.10.1

JavaScript / Python / Java ecosystems are not the primary delivery path for this issue, but if your tooling wraps LXD or provisions it, update the wrapper dependency to a fixed release and pin the version explicitly:

# npm / yarn / pnpm
npm i TODO_PACKAGE@^TODO_FIXED_VERSION
yarn add TODO_PACKAGE@^TODO_FIXED_VERSION
pnpm add TODO_PACKAGE@^TODO_FIXED_VERSION

# pip / pipx
pip install -U TODO_PACKAGE==TODO_FIXED_VERSION
pipx upgrade TODO_PACKAGE

# Maven / Gradle
# Maven pom.xml: set version to TODO_FIXED_VERSION
# Gradle:
implementation("TODO_GROUP:TODO_ARTIFACT:TODO_FIXED_VERSION")

Hardening while you patch

# Example firewall restriction: allow only your admin IP
sudo ufw allow from YOUR.ADMIN.IP.ADDRESS to any port 8443 proto tcp
sudo ufw deny 8443/tcp

# If using iptables
sudo iptables -A INPUT -p tcp --dport 8443 -s YOUR.ADMIN.IP.ADDRESS -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8443 -j DROP

Config hardening example

# Prefer binding to localhost or a private management network only
lxc config set core.https_address 127.0.0.1:8443
# or
lxc config set core.https_address 10.0.0.10:8443

Minimal code/ops fix pattern if you maintain automation around certificate trust: reject any client certificate chain that is not anchored to the expected trust store and do not accept “any trusted client” based on partial chain matching.

# Pseudocode
if !verifyClientCertChain(cert, trustedRoots, requireExactChain=true) {
    denyConnection()
}

Detection & Verification

Check the installed version

lxd --version
snap list lxd
apt-cache policy lxd
rpm -q lxd

Check for exposed listeners

ss -lntp | grep 8443
lsof -iTCP:8443 -sTCP:LISTEN

Inspect configuration and trust settings

lxc config get core.https_address
lxc config show
grep -R "https_address\|trust\|certificate" /var/snap/lxd/common/lxd/ 2>/dev/null

Look for suspicious client trust activity

journalctl -u snap.lxd.daemon --since "7 days ago" | grep -Ei "certificate|trust|auth|TLS|HTTPS"
grep -R "trusted" /var/snap/lxd/common/lxd/logs/ 2>/dev/null

Verify the fix

# Confirm the version is one of the fixed releases
lxd --version

# Confirm the service is only reachable from approved networks
curl -k https://127.0.0.1:8443/1.0
# From an untrusted host, the connection should be blocked by network policy

Risk and Impact

This flaw can let an attacker impersonate a trusted LXD client without valid authorization. If successful, they may gain control over the cluster, create or modify containers and VMs, access sensitive data, and potentially pivot deeper into your infrastructure.

For small teams, the practical impact is outsized: one exposed management endpoint can compromise every workload managed by that LXD instance. Treat this as an emergency patch-and-contain event, not a routine update.

Keep reading