CriticalCVECVE-2026-112816
Critical Certificate Validation Flaw in LXD and Incus Could Give Hackers Control of Linux Hosts
Cyber Security News·Source published ·1 min read
What happened?
A critical certificate validation flaw in LXD and Incus could let remote attackers bypass login checks and take control of clusters and managed virtual machines. The weakness affects the HTTPS management listener, placing exposed Linux systems at risk without requiring a password, stolen private key, or user interaction. Incus rates its flaw critical, with a CVSS score of 10.0. The Incus security advisory, published on October 29, says the bug has existed since the project’s initial release. Canonical published its related LXD record, CVE-2026-112816, on October 30.
Key details
- TLS certificate validation does not verify remaining certificates in the chain after the first one.
- Attackers can append a trusted certificate's public part to their own chain and be accepted as its owner without the private key.
- Presenting server's own certificate grants database gateway access; another cluster member's certificate grants internal cluster access and bypasses authorization.
- Incus versions before 7.6.0 are affected; LXD fixes in 4.0.15, 5.0.11, 5.21.9, and 6.10.1.
- Attackers can impersonate trusted client, metrics, or server certificates using relevant public certificates.
Affected
- Incus versions before 7.6.0 are affected.
Fixes and mitigations
- Incus version 7.6.0 and later are patched.
- LXD fixes in versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1 for affected release branches.
What to look for
- Attackers can impersonate trusted client, metrics, or server certificates using relevant public certificates.
- Attackers can renew or delete trust store entries through self-service paths.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.