Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10,…

Canonical LXD

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Do this now

Upgrade LXD to 6.10.1, 5.21.9, 5.0.11 or 4.0.15, matching your release line.

Fix it

LXD

On 4.0.xUpgrade to LXD 4.0.15
On 5.0.xUpgrade to LXD 5.0.11
On 5.21.xUpgrade to LXD 5.21.9
On 6.10.xUpgrade to LXD 6.10.1

First seen: 31 Oct 2026
Last update: 31 Oct 2026, 17:17 UTC
Fixed in: 6.10.1
5.21.9
5.0.11
4.0.15
Identifiers: CVE-2026-112816
CVSS: 10.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10,…
Severity: critical. Patch status: patched.
Affected: Canonical LXD
Fixed in: 6.10.1, 5.21.9, 5.0.11, 4.0.15
Ids: CVE-2026-112816

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

## Steps
1. Search the repo, its CI and infra config for Canonical LXD. If present, report the version in use and whether it's affected.
2. Fix by release line: LXD: 6.10.1; 5.21.x → 5.21.9; 5.0.x → 5.0.11; 4.0.x → 4.0.15.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| LXD | fixed | 6.10.1 | — |
| LXD 5.21.x | fixed | 5.21.9 | — |
| LXD 5.0.x | fixed | 5.0.11 | — |
| LXD 4.0.x | fixed | 4.0.15 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-112816") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571 https://nvd.nist.gov/vuln/detail/CVE-2026-112816
https://pwned.coffee/i/improper-certificate-validation-in-the-https-listener-in-cve-2026-112816

Timeline

31 Oct 2026, 17:17 UTC
Fix status: unknown → patched.
31 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
LXD before 6.10.1 6.10.1 CVE record (CNA) checked 31 Oct
LXD 5.21.8 to before 5.21.9 5.21.9 CVE record (CNA) checked 31 Oct
LXD 5.0.10 to before 5.0.11 5.0.11 CVE record (CNA) checked 31 Oct
LXD 4.0.14 to before 4.0.15 4.0.15 CVE record (CNA) checked 31 Oct
Score: CVSS 10.0 (critical). CVSS 4.0 10 (CNA canonical) for CVE-2026-112816
Last checked: 31 Oct 2026, 23:18 UTC

Product	Affected	Fixed in	Source
LXD	before 6.10.1	6.10.1	CVE record (CNA) checked 31 Oct
LXD	5.21.8 to before 5.21.9	5.21.9	CVE record (CNA) checked 31 Oct
LXD	5.0.10 to before 5.0.11	5.0.11	CVE record (CNA) checked 31 Oct
LXD	4.0.14 to before 4.0.15	4.0.15	CVE record (CNA) checked 31 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee