# Canonical LXD certificate validation flaw patched

Published: 2026-11-02 · Severity: routine · Sectors: Technology, Infrastructure
Canonical: https://vorant.io/reports/66ced084-4c50-50d7-980c-05ed6a118a35/canonical-lxd-certificate-validation-flaw-patched
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A critical LXD HTTPS API flaw (CVSS 10.0) lets attackers with a trusted client's public certificate impersonate that client, potentially gaining root host access.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0464.html

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL published an advisory for CVE-2026-112816, a critical Improper Certificate Validation vulnerability in Canonical's LXD container/VM management system. The flaw stems from LXD's HTTPS API incorrectly validating every certificate in a presented certificate chain against its trust store, rather than cryptographically verifying only the leaf certificate's possession of the corresponding private key. This design flaw allows unauthenticated attackers with network access to the HTTPS API, who also possess the public certificate of a trusted client, to impersonate that client without needing the client's private key.

Successful exploitation grants the attacker privileges equivalent to the impersonated client, which could include unauthorized access to the LXD cluster and managed virtual machines. If the impersonated client holds sufficient administrative privileges, this could escalate to root access on the underlying host system. The vulnerability affects multiple supported LXD release branches (versions before 4.0.15, 5.0.11, 5.21.9, and 6.10.1) as well as MicroCloud environments, making it relevant to a broad range of Canonical/Debian-based container infrastructure deployments.

Canonical has released patched versions addressing this issue. There is no indication in this advisory of active exploitation in the wild; this is a vendor-patched vulnerability disclosure. Defenders operating LXD or MicroCloud should prioritize upgrading to the fixed versions given the maximum CVSS 4.0 score of 10.0 and the potential for full host compromise via certificate chain validation bypass.

## Mentioned in this report

- Vulnerabilities: CVE-2026-112816

## Detection guidance (public sample)

### LXC Device Added Mounting Host Root Filesystem

ATT&CK: T1611

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the lxc client adding a disk device whose source is the host root filesystem, a common route to host root after gaining LXD API privileges, including through certificate impersonation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LXC Device Added Mounting Host Root Filesystem
description: Detects the lxc client adding a disk device whose source is the host
  root (source=/), the usual way to reach host root from an LXD client. Relevant post-exploitation
  after LXD API client impersonation (CVE-2026-112816).
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_base:
    Image|endswith:
    - /lxc
    - /lxd
    CommandLine|contains|all:
    - device add
    - disk
  selection_root_space:
    CommandLine|contains: 'source=/ '
  selection_root_end:
    CommandLine|endswith: source=/
  condition: selection_base and 1 of selection_root_*
falsepositives:
- Administrators deliberately mounting the host root into a trusted maintenance container
- Infrastructure automation that attaches host paths to containers
level: high
id: 42c0166e-2bc1-5ae2-9eed-fccc650dcd40
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0464.html
```

### LXC Container Set to Privileged Mode

ATT&CK: T1611

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the lxc client creating or modifying a container with security.privileged enabled, which weakens isolation and is used to escape to the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LXC Container Set to Privileged Mode
description: Detects lxc commands that enable security.privileged on a container,
  which removes user namespace isolation and is commonly used for host escape after
  obtaining LXD API access (for example via CVE-2026-112816 client impersonation).
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /lxc
    - /lxd
    CommandLine|contains:
    - security.privileged=true
    - security.privileged true
  condition: selection
falsepositives:
- Legitimate workloads that require privileged containers, such as certain nested
  container or legacy application setups
- Provisioning scripts that set privileged mode in profiles
level: medium
id: 4dc2aac9-5951-5e90-96f3-b40a224258ae
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0464.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0464.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/66ced084-4c50-50d7-980c-05ed6a118a35/canonical-lxd-certificate-validation-flaw-patched.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup