Unverified client certificate chain
Authentication checks intermediate certificates instead of requiring proof from the leaf certificate.
LXD and MicroCloud allow client impersonation with a trusted public certificate
An attacker reaching the HTTPS API can impersonate a trusted client using its public certificate, without its private key. Host-root access depends on the impersonated identity's privileges.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- Sharted
- 1 CVE tracked here
- Splash zone
- Reachable LXD or MicroCloud APIs where an attacker obtains a trusted client's public certificate
- LXD · MicroCloud · authentication
- In the wild
- Unknown
- Canonical confirms the flaw; its notice does not report active exploitation.
What happened
MicroCloud joining-member certificates can also be intercepted and reused. A certificate alone is insufficient without API reachability. L3 reflects a mainstream daemon authentication bypass; exploitation and victim counts are unconfirmed.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| LXD 6/stable | 6.10.1 | |
| LXD 5.21/stable | 5.21.9 | |
| LXD 5.0/stable | 5.0.11 | |
| LXD 4.0/stable | 4.0.15 | |
| MicroCloud 2/stable | 2.1.5 | |
| MicroCloud 3/stable | 3.4.1 |
Crime-scene timeline
Oct 28, 17:50 UTC
Canonical publishes advisory
Oct 29, 2026
Listed fixed snaps released
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.