# Critical Security Flaw in LXD and MicroCloud Allows Unauthorized Access

*Published November 2, 2026*
*Source: [https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html](https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/critical-security-flaw-in-lxd-and-microcloud-allows-unauthorized-access) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A severe vulnerability has been identified in Canonical's LXD and MicroCloud platforms, allowing attackers to impersonate trusted clients without possessing the private keys. This flaw can be exploited by accessing the HTTPS API and using the public certificate of a trusted client. Once inside, the attacker can operate as the trusted client, potentially gaining root access to the host machine if the impersonated account holds privileged status. Canonical has acknowledged this issue, labeled as CVE-2026-112816, which has been assigned the highest CVSS score of 10.0. Both LXD and MicroCloud have released updates to address this vulnerability. 

The flaw lies in the mutual TLS authentication process, where the server verifies a certificate provided by the client against its trust store. However, the TLS connection only ensures the client owns the private key for the initial certificate in the chain. An attacker can attach a trusted client's public certificate behind their own, allowing the server to accept their connection. This exploit requires network access to the HTTPS API and the public certificate of a trusted client. 

By default, a standalone LXD server does not expose its API. It listens on a local socket unless the network API is enabled by an administrator. MicroCloud, which connects multiple LXD instances into a cluster, is particularly vulnerable when a member's public certificate is captured during cluster joining. Canonical lists specific LXD versions affected by this flaw but not the Ubuntu archive packages. The Incus project, which reported the issue, has already released a fix in version 7.6.0. 

Although there is no evidence of this flaw being exploited in the wild, organizations are urged to update their LXD and MicroCloud installations. For snap installations, users should execute sudo snap refresh lxd and sudo snap refresh microcloud commands to update. While Canonical's advisory notes that updates are still being rolled out, it is crucial to verify the installed version post-refresh to ensure the fix is applied. Until updated, limiting network access to the API can mitigate risks.