Threat reportVulnerabilityTL-2026-4981
CVE-2026-112816: CVSS 10.0 LXD and MicroCloud TLS Client Authentication Bypass (Impersonation Without Private Key)
CVE-2026-112816 (TL-2026-4981), also tracked as GHSA-99jp-jwmc-65p4, is a critical-severity software vulnerability scored CVSS 10, first published 2026-11-01. It has no confirmed attribution, affects Canonical LXD, references 1 CVE (CVE-2026-112816), maps to 5 MITRE ATT&CK techniques (T1040, T1078, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4981
- Threat ID
- TL-2026-4981
- Also known as
- GHSA-99jp-jwmc-65p4, GHSA-xg75-xf37-cph9
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud-hosting, telecoms, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-112816 works
A CVSS 10.0 improper certificate validation flaw in the LXD and MicroCloud HTTPS listener (also affecting Incus before 7.6.0) lets a network attacker authenticate as any trusted client using only that client's public certificate, with no private key. Patches shipped 2026-10-29; no public exploit and no known exploitation as of CISA's 2026-10-30 assessment.
CVE-2026-112816 is an authentication and authorization bypass in the HTTPS API listener of Canonical LXD and MicroCloud, and in the Incus fork (tracked separately as GHSA-xg75-xf37-cph9). The server compared every peer certificate the client sent in the TLS handshake against its trust store, but only the leaf certificate proves possession of the corresponding private key. An attacker can therefore present a chain in which a trusted client's public certificate is appended behind the attacker's own certificate. The server finds the trusted certificate in the chain and treats the connection as authenticated as that client, even though the attacker never held the matching private key.
Exploitation requires network access to the HTTPS API listener and possession of a trusted client's public certificate. Public certificates are not secret. For MicroCloud, the advisory notes an attacker can capture a member's public certificate as it joins the cluster. No privileges and no user interaction are required. NVD scores the issue CVSS v4.0 10.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and classifies it as CWE-295. The Incus advisory scores it CVSS v3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with CWE-287 and CWE-295.
Impact is full API access as the impersonated identity: access to the cluster and its virtual machines, influence over authorization decisions, and, depending on the privileges of the impersonated client, root access to the host machine. There is no configuration-based workaround. Operators must update and restrict network access to the HTTPS listener to trusted hosts. Fixed releases are LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, MicroCloud 3.4.1 and 2.1.5, and Incus 7.6.0. Ubuntu rates the CVE priority Medium and reports the LXD snap flaw as not present in Ubuntu 22.04, 24.04, 26.04 and 26.10 archive packages. The LXD snap is updated through `snap refresh lxd` and `snap refresh microcloud`. The issue was reported by stgraber. As of 2026-10-30 it is not on CISA KEV, and no public exploit has been published.
MITRE ATT&CK techniques used in TL-2026-4981
Credential Access
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
lateral-movement
T1550 Use Alternate Authentication Material
Privilege Escalation
Affected products and versions in CVE-2026-112816
Remediation for CVE-2026-112816
Patches
- LXD 6.10.1 / 5.21.9 / 5.0.11 / 4.0.15
- MicroCloud 3.4.1 / 2.1.5
- Incus 7.6.0
Immediate actions
- Update LXD to 6.10.1, 5.21.9, 5.0.11 or 4.0.15 (sudo snap refresh lxd)
- Update MicroCloud to 3.4.1 or 2.1.5 (sudo snap refresh microcloud)
- Update Incus to 7.6.0 or later
- Restrict network access to the LXD/MicroCloud/Incus HTTPS listener to trusted hosts only
Workarounds
- No configuration-based workaround exists; restrict network access to the HTTPS listener to trusted hosts
Longer-term hardening
- Keep the HTTPS API listener off untrusted networks and place it on a dedicated management network
- Review the trust store for unexpected client certificates and audit API access logs for unfamiliar source addresses
CVEs associated with CVE-2026-112816
Weaknesses (CWE) in CVE-2026-112816
Timeline of CVE-2026-112816
- Incus publishes GHSA-xg75-xf37-cph9 (CVSS 3.1 10.0, CWE-287/CWE-295), fixed in Incus 7.6.0; reporter credited as stgraber.
- Canonical releases fixed LXD (6.10.1, 5.21.9, 5.0.11, 4.0.15) and MicroCloud (3.4.1, 2.1.5) versions; the Canonical security advisory is published.
- CISA assessment finds no known exploitation; the CVE is not on the CISA KEV catalog.
- CVE-2026-112816 is published in NVD and on the Ubuntu security tracker (CVSS v4.0 10.0, CWE-295).
- NVD record for CVE-2026-112816 is last modified.
- The Hacker News reports the flaw, noting that no working exploit has been published.
Sources cited for CVE-2026-112816
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
- NVD - CVE-2026-112816
- Ubuntu Security - CVE-2026-112816
- Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud
- Incus GHSA-xg75-xf37-cph9: Authentication and authorization bypass through unverified client certificate chains
Detection coverage for TL-2026-4981
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4981 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.