Read the docs
TI-2026-83216 Aliases CVE-2026-112816GHSA-pq55-m3w3-jh54

Improper certificate validation in LXD HTTPS listener

Priority MEDIUM 49CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Canonical LXD versions from 4.0.14 before 4.0.15, from 5.0.10 before 5.0.11, from 5.21.8 before 5.21.9, and from 6.9.0 before 6.10.1 are affected. Improper certificate validation (CWE-295) in the HTTPS listener lets an unauthenticated remote attacker authenticate as any trusted client by using a crafted certificate chain. This gives full access to the cluster and its managed virtual machines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Fix Fixed LXD (Canonical): 4.0.15, 5.0.11, 5.21.9 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalLXD4.0.14 to before 4.0.15; 5.0.10 to before 5.0.11; 5.21.8 to before 5.21.9; 6.9.0 to before 6.10.14.0.15, 5.0.11, 5.21.9, 6.10.1Patch availableCNA
  • LXD VendorCanonical Affected 4.0.14 to before 4.0.15; 5.0.10 to before 5.0.11; 5.21.8 to before 5.21.9; 6.9.0 to before 6.10.1 Fixed in 4.0.15, 5.0.11, 5.21.9, 6.10.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*——Canonical
  • cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Versions — — ·Canonical

Remediation

Upgrade LXD to 4.0.15, 5.0.11, 5.21.9, or 6.10.1, matching the release branch in use.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA LXD (Canonical) Fixed in 4.0.15, 5.0.11, 5.21.9, 6.10.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-112816
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Alias added: GHSA-pq55-m3w3-jh54
  4. 2026-10-31 CISA SSVC decision points changed

References

Advisory 2

Other 4

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences