Critical LXD and MicroCloud flaw lets attackers impersonate trusted clients without their private key

The Incus project reported, and Canonical confirmed, CVE-2026-112816, a flaw rated 10.0 in LXD and MicroCloud that lets an attacker with network access to the HTTPS API impersonate any trusted client. The server checked each certificate the client sent against the trust store, but a TLS connection only proves the client holds the private key for the leaf certificate, so an attacker can attach a trusted client's non-secret public certificate behind their own and be accepted as that client. Fixes are in LXD 6.10.1, 5.21.9, 5.0.11, and 4.0.15, MicroCloud 3.4.1 and 2.1.5, and Incus 7.6.0. No exploitation is reported, and a standalone LXD server does not expose the API by default.

Check

Upgrade LXD, MicroCloud, or Incus to the fixed release for your branch, and restrict network access to the HTTPS API to trusted management hosts.

Affected

LXD or MicroCloud servers exposing the HTTPS API let an attacker attach a trusted client's public certificate behind their own and be accepted as that client.

Fix

Apply the fixed LXD, MicroCloud, or Incus versions, keep the API off untrusted networks, and review the trust store and API access logs.