Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112816updated 30 Oct 2026, 23:02 UTC

LXD server lets attackers bypass login and take over the cluster

A flaw in LXD, a tool for running virtual machines and containers on servers, lets an outsider pretend to be a trusted admin. This can give them control of the whole cluster and every virtual machine on it.

Fix available · out Official, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesLXD 4.0.15, 5.0.11, 5.21.9, 6.10.1 or later · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Outside attackerNo login or account needed
  2. 2Crafted certificateForged chain sent to HTTPS listener
  3. 3LXD accepts itCertificate validation is improper
  4. 4Trusted client accessAttacker is treated as a trusted admin
  5. ResultAttacker controls the cluster and its VMs

What happened

Improper certificate validation in the HTTPS listener of Canonical LXD allows an unauthenticated attacker to authenticate as any trusted client using a crafted certificate chain.

Why it is dangerous: An attacker gets full access to the cluster and all managed virtual machines, so data and workloads on those machines can be read, changed or destroyed. Anyone running exposed LXD servers or clusters is at risk.

Are you affected?

You are affected if you run LXD 4.0.14 or earlier 4.0.x builds, 5.0.10 or earlier 5.0.x builds, 5.21.8 or earlier 5.21.x builds, or 6.9 with an HTTPS listener reachable by others.

LXD 4.0.14 (and earlier 4.0.x); LXD 5.0.10 (and earlier 5.0.x); LXD 5.21.8 (and earlier 5.21.x); LXD 6.9

What to do

  1. Update LXD to 4.0.15, 5.0.11, 5.21.9, or 6.10.1 or later on every server and cluster member
  2. Restrict network access to the LXD HTTPS port so only trusted management hosts can reach it
  3. Review LXD trust store and access logs for unexpected client certificates

Timeline

  1. 30 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 17:19 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:02 UTC
    Hacker News reported on it · Hacker News

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Community discussion sites, treat with care

Technical details

ID
CVE-2026-112816
CVSS
10 / 10
Disclosed
30 Oct 2026, 17:17 UTC
On Zero Radar
30 Oct 2026, 17:19 UTC (2 min after disclosure)
Last change
30 Oct 2026, 23:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

LXD server lets attackers bypass login and take over the cluster · Zero Radar