Critical CVE-2026-112816: LXD and MicroCloud Permit Trusted Client Impersonation (CVSS 10.0)
A newly disclosed critical vulnerability affecting Canonical's LXD and MicroCloud allows an attacker to authenticate as a trusted client without possessing that client's private key. Because the flaw undermines the server's certificate checks during mutual TLS authentication, an attacker with network access to the HTTPS API and a trusted client's public certificate can present a crafted certificate chain and be accepted as the trusted identity. Canonical has released patched snap…