Canonical LXD CVE-2026-112816

Exploitation requires network reachability to the LXD daemon's HTTPS API listener (the trust/remote API endpoint used for clustering and remote management), which must be enabled and exposed - an installation restricted to the local Unix socket with no HTTPS listener configured is not remotely reachable. When the HTTPS listener is reachable, no further conditions apply: the attacker needs no valid certificate, no credentials, and no user interaction (AV:N/AC:L/PR:N/UI:N), because the flaw lets a crafted certificate chain pass validation and be accepted as an already-trusted client. The primary limiting factor is thus network exposure of the HTTPS listener; clustered LXD and MicroCloud deployments, which rely on this listener, are the most exposed. Affected builds are LXD 4.0.14, 5.0.10, 5.21.8, and 6.9 (and earlier within each branch); fixed builds (4.0.15, 5.0.11, 5.21.9, 6.10.1) are not exploitable. Per the vendor, updating is the remedy.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the impact metrics are maximal on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) because a successful attack yields full control of the LXD cluster and every managed virtual machine - hence the 10.0 score. The vuln.today decision label is 'act_now', which aligns with the maximal severity and the fact that it was reported by the vendor (Canonical) with a published GitHub Security Advisory and a critical Ubuntu Discourse advisory. Signals are consistent rather than conflicting: there is no EPSS score provided and no CISA KEV listing, so there is no evidence of active exploitation in the wild, and no public exploit reference is supplied - the urgency here derives from the mechanism (complete authentication bypass) and vendor prioritization, not from observed attacks. Missing data to note explicitly: no EPSS probability was provided, KEV status is not indicated (treat as not listed), and no proof-of-concept is referenced, so exploitation is assessed as mechanistically trivial but not yet publicly demonstrated.

An attacker with network reachability to an LXD daemon's HTTPS API listener presents a crafted certificate chain that the listener improperly validates, causing the daemon to accept the attacker as an already-trusted client without any valid credential. Having bypassed authentication, the attacker gains full administrative control over the LXD cluster and all managed virtual machines. No public exploit is referenced in the available sources, but the attack requires no authentication, no user interaction, and low complexity.