VDB
CVE-2026-112816
CVE-2026-112816
PUBLISHED
CVSS 10 CRITICAL
Reported by canonical · Published October 30, 2026
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Risk Scores
CVSS 4.0
10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | LXD | 4.0.14, 5.0.10, 5.21.8 |
| Canonical | LXD | 4.0.14, 5.0.10, 5.21.8 |
Timeline
- Oct 30, 2026 Coalition ESS Score
- Oct 30, 2026 CVE Published
- Oct 31, 2026 EPSS Score
- Oct 31, 2026 CVE Updated