---
id: CVE-2026-112816
title: Improper certificate validation in the HTTPS listener in LXD
summary: "Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9\_before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the…"
severity: critical
cvss: 10
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-295
vendor: Canonical
product: lxd
affected:
  - lxd >= 4.0.14 < 4.0.15
  - lxd >= 5.0.10 < 5.0.11
  - lxd >= 5.21.8 < 5.21.9
  - lxd >= 6.9.0 < 6.10.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-30T00:00:00+00:00'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T03:56:41.468Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112816'
references:
  - url: 'https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4'
  - url: >-
      https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557
  - url: 'https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024'
  - url: 'https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1'
  - url: 'https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1'
  - url: 'https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571'
tags:
  - cve.org
  - exploit-available
epss: 0.00303
epssPercentile: 0.23251
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/dehasoft-tr/cve-2026-112816'
    - 'https://github.com/MrNarsus/cve-2026-112816-poc'
    - 'https://github.com/foxcornlab/lxd-scanner'
  checkedAt: '2026-11-05T16:25:07.474Z'
ingestedAt: '2026-11-05T16:24:31.527Z'
---

## Overview

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

## Affected

- `lxd >= 4.0.14 < 4.0.15`
- `lxd >= 5.0.10 < 5.0.11`
- `lxd >= 5.21.8 < 5.21.9`
- `lxd >= 6.9.0 < 6.10.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.