Canonical LXD certificate validation flaw patched
A critical LXD HTTPS API flaw (CVSS 10.0) lets attackers with a trusted client's public certificate impersonate that client, potentially gaining root host access.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory for CVE-2026-112816, a critical Improper Certificate Validation vulnerability in Canonical's LXD container/VM management system. The flaw stems from LXD's HTTPS API incorrectly validating every certificate in a presented certificate chain against its trust store, rather than cryptographically verifying only the leaf certificate's possession of the corresponding private key. This design flaw allows unauthenticated attackers with network access to the HTTPS API, who also possess the public certificate of a trusted client, to impersonate that client without needing the client's private key.
Successful exploitation grants the attacker privileges equivalent to the impersonated client, which could include unauthorized access to the LXD cluster and managed virtual machines. If the impersonated client holds sufficient administrative privileges, this could escalate to root access on the underlying host system. The vulnerability affects multiple supported LXD release branches (versions before 4.0.15, 5.0.11, 5.21.9, and 6.10.1) as well as MicroCloud environments, making it relevant to a broad range of Canonical/Debian-based container infrastructure deployments.
Canonical has released patched versions addressing this issue. There is no indication in this advisory of active exploitation in the wild; this is a vendor-patched vulnerability disclosure. Defenders operating LXD or MicroCloud should prioritize upgrading to the fixed versions given the maximum CVSS 4.0 score of 10.0 and the potential for full host compromise via certificate chain validation bypass.
Mentioned in this report
Detection guidance
LXC Device Added Mounting Host Root Filesystem
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the lxc client adding a disk device whose source is the host root filesystem, a common route to host root after gaining LXD API privileges, including through certificate impersonation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LXC Device Added Mounting Host Root Filesystem
description: Detects the lxc client adding a disk device whose source is the host
root (source=/), the usual way to reach host root from an LXD client. Relevant post-exploitation
after LXD API client impersonation (CVE-2026-112816).
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
category: process_creation
product: linux
detection:
selection_base:
Image|endswith:
- /lxc
- /lxd
CommandLine|contains|all:
- device add
- disk
selection_root_space:
CommandLine|contains: 'source=/ '
selection_root_end:
CommandLine|endswith: source=/
condition: selection_base and 1 of selection_root_*
falsepositives:
- Administrators deliberately mounting the host root into a trusted maintenance container
- Infrastructure automation that attaches host paths to containers
level: high
id: 42c0166e-2bc1-5ae2-9eed-fccc650dcd40
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0464.html
LXC Container Set to Privileged Mode
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the lxc client creating or modifying a container with security.privileged enabled, which weakens isolation and is used to escape to the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LXC Container Set to Privileged Mode
description: Detects lxc commands that enable security.privileged on a container,
which removes user namespace isolation and is commonly used for host escape after
obtaining LXD API access (for example via CVE-2026-112816 client impersonation).
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /lxc
- /lxd
CommandLine|contains:
- security.privileged=true
- security.privileged true
condition: selection
falsepositives:
- Legitimate workloads that require privileged containers, such as certain nested
container or legacy application setups
- Provisioning scripts that set privileged mode in profiles
level: medium
id: 4dc2aac9-5951-5e90-96f3-b40a224258ae
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0464.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0464.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs