Canonical LXD and MicroCloud Updates Fix TLS Trust Bypass
Tech GuruQuick Answer
Canonical fixed a critical LXD and MicroCloud mutual-TLS trust bypass. Inventory reachable APIs and exact channels, restrict untrusted access, refresh LXD and MicroCloud to the fixed snaps, validate client trust and cluster membership, review suspicious API activity, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory LXD and MicroCloud deployments, snap channels and revisions, HTTPS API listeners, trusted client certificates, joining workflows, cluster members, owners, and backups. Confirm an affected Canonical channel and reachable API; do not infer compromise from possession of a public certificate or apply the LXD range to unrelated LXC components. Restrict API reachability and run supported snap refreshes so LXD and MicroCloud reach the authority-listed fixed versions for their channels. Confirm snap revisions on every member, review trust entries and joining history, test cluster and API operations, inspect logs for unexpected authenticated activity, and retain evidence.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Canonical LXD and MicroCloud HTTPS API mutual-TLS authentication |
|---|---|
| Advisory | Canonical LXD and MicroCloud CVE-2026-112816 advisory |
| CVE | CVE-2026-112816 |
| Authoritative release date | 2026-10-28 17:50:00 UTC |
| Authority revision date | 2026-10-30 17:18:21.262 UTC |
| Affected versions | LXD 4.0.14 before 4.0.15, 5.0.10 before 5.0.11, 5.21.8 before 5.21.9, and 6.9.0 before 6.10.1; affected MicroCloud channels before 2.1.5 or 3.4.1. |
| Fixed version | LXD 4.0.15, 5.0.11, 5.21.9, or 6.10.1; MicroCloud 2.1.5 or 3.4.1 |
| CVSS base score | 10.0 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Canonical does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Canonical fixed mutual-TLS certificate-chain validation that could let a reachable attacker impersonate a trusted client using its public certificate and, depending on that identity, gain host-root access.
What To Validate Now
- Inventory. Inventory LXD and MicroCloud deployments, snap channels and revisions, HTTPS API listeners, trusted client certificates, joining workflows, cluster members, owners, and backups.
- Establish applicability. Confirm an affected Canonical channel and reachable API; do not infer compromise from possession of a public certificate or apply the LXD range to unrelated LXC components.
- Remediate. Restrict API reachability and run supported snap refreshes so LXD and MicroCloud reach the authority-listed fixed versions for their channels.
- Validate. Confirm snap revisions on every member, review trust entries and joining history, test cluster and API operations, inspect logs for unexpected authenticated activity, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Progressive rollout can delay a stable-channel refresh. Coordinate clustered upgrades and verify every member rather than assuming one refreshed node proves fleet remediation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
