Low Severity
CVE-2026-112816
Published: Nov 2, 2026
Independent lab reproduction and post-patch verification tool for CVE-2026-112816 (LXD/MicroCloud mTLS chain bypass).
# CVE-2026-112816 — LXD / MicroCloud client-certificate chain authentication bypass
**Independent reproduction, root-cause analysis, and detection guidance.**
---
## TL;DR
LXD and MicroCloud authenticate remote API clients over mutual TLS by comparing the client's
certificate against a trust store. Before the fix, the server compared **every certificate the
client sent** against that store, instead of only the **leaf**.
Only the leaf proves possession of a private key. Certificates after the leaf are unauthenticated
data the client chose to attach. An attacker who can reach the HTTPS API and who knows the
**public** certificate of any trusted client can therefore:
1. generate their own throwaway keypair,
2. send `[attacker leaf] + [victim's public certificate]` as their TLS client chain,
3. be accepted by the server as the victim.
The victim's public certificate is not a secret — it is presented in the handshake, is present in
cluster join traffic in MicroCloud, and is routinely recorded in configuration management. No
private key is needed.
Impact is bounded only by what the impersonated client may do. If that client is unrestricted,
the attacker effectively gains control of the LXD daemon and, through it, the host.
| | |
|---|---|
| **CVE** | [CVE-2026-112816](https://www.cve.org/CVERecord?id=CVE-2026-112816) |
| **Class** | CWE-295 Improper Certificate Validation → authentication bypass |
| **Advisory** | [Canonical security advisory, 28 Oct 2026](https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557) |
| **Reported by** | Referred to Canonical by the Incus project (credited there: stgraber) |
| **Fixed** | LXD `6.10.1`, `5.21.9`, `5.0.11`, `4.0.15` · Mic