CVE-2026-112816: Improper certificate validation in the HTTPS listener in LXD
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Canonical's LXD container and VM manager has a critical flaw (CVE-2026-112816, CVSS 10) in its HTTPS listener, where improper certificate validation lets an unauthenticated attacker using a crafted certificate chain authenticate as any trusted client and gain full control of the cluster and managed VMs.