# CVE-2026-112816: CVSS 10.0 LXD and MicroCloud TLS Client Authentication Bypass (Impersonation Without Private Key)

> A CVSS 10.0 improper certificate validation flaw in the LXD and MicroCloud HTTPS listener (also affecting Incus before 7.6.0) lets a network attacker authenticate as any trusted client using only that client's public certificate, with no private key. Patches shipped 2026-10-29; no public exploit and no known exploitation as of CISA's 2026-10-30 assessment.

- **Published:** 2026-11-01T09:50:07Z
- **Last reviewed:** 2026-11-01T09:50:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4981
- **ID:** TL-2026-4981
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-112816

## Description

CVE-2026-112816 is an authentication and authorization bypass in the HTTPS API listener of Canonical LXD and MicroCloud, and in the Incus fork (tracked separately as GHSA-xg75-xf37-cph9). The server compared every peer certificate the client sent in the TLS handshake against its trust store, but only the leaf certificate proves possession of the corresponding private key. An attacker can therefore present a chain in which a trusted client's public certificate is appended behind the attacker's own certificate. The server finds the trusted certificate in the chain and treats the connection as authenticated as that client, even though the attacker never held the matching private key.

Exploitation requires network access to the HTTPS API listener and possession of a trusted client's public certificate. Public certificates are not secret. For MicroCloud, the advisory notes an attacker can capture a member's public certificate as it joins the cluster. No privileges and no user interaction are required. NVD scores the issue CVSS v4.0 10.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and classifies it as CWE-295. The Incus advisory scores it CVSS v3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with CWE-287 and CWE-295.

Impact is full API access as the impersonated identity: access to the cluster and its virtual machines, influence over authorization decisions, and, depending on the privileges of the impersonated client, root access to the host machine. There is no configuration-based workaround. Operators must update and restrict network access to the HTTPS listener to trusted hosts. Fixed releases are LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, MicroCloud 3.4.1 and 2.1.5, and Incus 7.6.0. Ubuntu rates the CVE priority Medium and reports the LXD snap flaw as not present in Ubuntu 22.04, 24.04, 26.04 and 26.10 archive packages. The LXD snap is updated through `snap refresh lxd` and `snap refresh microcloud`. The issue was reported by stgraber. As of 2026-10-30 it is not on CISA KEV, and no public exploit has been published.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1040 Network Sniffing
- T1611 Escape to Host

## Sources

- [CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key](https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html)
- [NVD - CVE-2026-112816](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112816)
- [Ubuntu Security - CVE-2026-112816](https://ubuntu.com/security/CVE-2026-112816)
- [Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud](https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557)
- [Incus GHSA-xg75-xf37-cph9: Authentication and authorization bypass through unverified client certificate chains](https://github.com/lxc/incus/security/advisories/GHSA-xg75-xf37-cph9)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4981