Taiwan Information Security Association
Join TWISA
Menu

Vulnerability advisoryFri, 6 Nov 2026

LXD and MicroCloud: restrict management API access and patch certificate validation

A certificate-chain validation flaw in LXD, MicroCloud and Incus management services may let reachable attackers impersonate trusted identities, affecting containers, virtual machines and hosts. Update the appropriate product branch and review management and trust settings.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

When enterprises use LXD and MicroCloud to manage containers, virtual machines and clusters, management API trust settings directly affect host security. An attacker who can reach an affected HTTPS service and obtain a trusted identity's public certificate may impersonate that identity. With sufficient privileges, the impact may extend to root access on the host.

On 2026/10/30, Canonical CNA published CVE-2026-112816 with CVSS v4.0 10.0. Canonical's 11/04 GHSA separately lists CVSS v3.1 10.0. The attack does not require the trusted identity's private key, and a server's public certificate can also be obtained during a TLS handshake.

Attack flowPossible attack chain against management services
  1. 01

    API reachability and public certificates

    The attacker reaches the HTTPS listener and obtains a trusted public certificate

  2. 02

    Certificate chain incorrectly trusted

    A crafted certificate chain passes the affected validation logic

  3. 03

    Management identity impersonated

    The scope of operations depends on the impersonated identity's permissions

  4. 04

    Clusters and hosts affected

    Containers, virtual machines, clusters and hosts may be modified

Affected versions and update targets

  • The LXD CNA lists these affected ranges: 4.0.14 to below 4.0.15, 5.0.10 to below 5.0.11, 5.21.8 to below 5.21.9, and 6.9.0 to below 6.10.1.
  • Canonical's Snap advisory lists patched versions LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1, and MicroCloud 2.1.5 and 3.4.1. Update to the applicable patched version or a later version in the branch and channel you use.
  • The LXD GHSA also lists 6.10.0 as patched, differing from the CNA range. For 6/stable, use 6.10.1 from the Snap advisory as the update target and verify the installed result.
  • Incus separately announced a similar issue as GHSA-xg75-xf37-cph9. Versions before 7.6.0 are affected, with a fix starting at 7.6.0. The score is CVSS v3.1 10.0; the advisory does not list a CVE identifier.

Restrict HTTPS management access first, then complete the update. Review both management reachability and how public certificates can be obtained. Source restrictions reduce exposure but cannot replace an update.

Response flowRecommended actions: from the perimeter to core systems
  1. 01

    Restrict management access

    Inventory production, backup, outsourced and cloud nodes. Allow HTTPS management API access only from necessary trusted sources, and isolate management networks and maintenance paths.

    See what to doResources: 2

    TWISA member solutions

    Restrict management access

    Inventory production, backup, outsourced and cloud nodes. Allow HTTPS management API access only from necessary trusted sources, and isolate management networks and maintenance paths.

  2. 02

    Update every node

    Update by product and Snap channel, and verify installed versions, cluster consistency and business functions. Preserve original settings and recoverable backups.

    See what to doResources: 1

    TWISA member solutions

    Update every node

    Update by product and Snap channel, and verify installed versions, cluster consistency and business functions. Preserve original settings and recoverable backups.

  3. 03

    Investigate management activity

    Preserve management API, host, network and trust-list records. Review changes to certificate trust, cluster membership and workloads.

    See what to doResources: 2

    TWISA member solutions

    Investigate management activity

    Preserve management API, host, network and trust-list records. Review changes to certificate trust, cluster membership and workloads.

  4. 04

    Recover and verify permissions

    If there are signs of compromise, preserve evidence before isolation and rebuilding from trusted sources. Rotate affected credentials and retest containers, virtual machines, backups and management permissions.

    See what to doResources: 2

    TWISA member solutions

    Recover and verify permissions

    If there are signs of compromise, preserve evidence before isolation and rebuilding from trusted sources. Rotate affected credentials and retest containers, virtual machines, backups and management permissions.

Defense architectureLayered protection for management, compute nodes and monitoring

Inventory all listeners, Snap channels, nodes, trusted certificates and management identities

Allow authorized traffic and apply controls at each layer.

  1. 01

    Management access

    Trusted maintenance sources and management networks

    Limit reachabilitySource allowlists, VPN and network segmentation

  2. 02

    Compute and clusters

    LXD、MicroCloud、Incus

    Update and control permissionsPatch every node, apply least privilege to management and maintain backups

  3. 03

    Core workloads

    Container, virtual machine and host data

    Reduce impact and recoverReview access boundaries and rebuild from trusted sources as indicated by the investigation

Feed logs and traffic data from each layer into monitoring and response.

  1. Monitoring and recoverySend management API, host and network records to centralized monitoring. Preserve trust and membership changes and verify backup usability.

Proactive testing and retesting

Within the authorized scope, perform asset discovery, vulnerability scanning, penetration testing, API testing and attack simulation. Verify management source restrictions, versions, trust and cluster isolation, then retest. Verify host and internal network permissions separately.

TWISA member solutions

Official sources

Contact the relevant members for more detailed product and service information.

Advisory updated: 2026/11/06. Consult the vendor's latest information for product support and patch status.