Canonical has released fixed versions of LXD and MicroCloud after disclosing a critical authentication flaw, tracked as CVE-2026-112816, carrying a maximum CVSS score of 10.0. Both products let remote clients reach their HTTPS APIs over mutual TLS, where a client is trusted when its certificate is in the server's trust store; the flaw was in how the server checked that certificate, comparing every certificate the client sent and thereby allowing an attacker to authenticate as a trusted client without holding its private key. The attacker must first reach the API over the network and possess the trusted client's public certificate. Once impersonating a client, the attacker gains that client's access to the cluster and its virtual machines and, where the impersonated account is privileged, "root access to the host machine." LXD and MicroCloud underpin private-cloud and container estates, making the flaw significant for any environment exposing the API to untrusted networks.

• Source article