{"id":122,"date":"2026-11-02T07:44:27","date_gmt":"2026-11-02T06:44:27","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-monday-2-november\/"},"modified":"2026-11-02T15:52:36","modified_gmt":"2026-11-02T14:52:36","slug":"patchwork-monday-2-november","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-monday-2-november\/","title":{"rendered":"Patchwork – Monday 2 November"},"content":{"rendered":"

This edition centres on a single vulnerability, but a serious one: in Canonical LXD and MicroCloud, an attacker can log in as a trusted client without the corresponding private key. The flaw has the maximum score of 10.0. Patches are available, and no exploitation has been reported yet.<\/strong><\/p>\n

LXD and MicroCloud: attacker logs in as a trusted client without a private key<\/h4>\n\n\n\n\n\n\n\n
Vulnerability<\/td>\nAuthentication bypass caused by improper validation of client certificate chains in the HTTPS listener of Canonical LXD (vulnerable up to and including 4.0.14, 5.0.10, 5.21.8 and 6.9) and MicroCloud. The Incus fork has the same problem<\/td>\n<\/tr>\n
CVE number<\/td>\nCVE-2026-112816<\/td>\n<\/tr>\n
CVSS score<\/td>\n10.0<\/td>\n<\/tr>\n
Actively exploited<\/td>\nNo. According to a CISA assessment in the CVE record dated 30 October, no exploitation is known, the flaw is not in the KEV catalogue and there is no public exploit<\/td>\n<\/tr>\n
Patch available<\/td>\nYes. LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, MicroCloud 3.4.1 and 2.1.5, Incus 7.6.0. There is no workaround; until you have patched, restrict network access to the API<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How can the vulnerability be exploited?<\/strong><\/p>\n

LXD and MicroCloud use mutual TLS: a client presents a certificate and the server trusts it if the certificate is in the trust store. According to Canonical’s advisory<\/a>, the server checked every certificate supplied by the client against that store, whereas only the first certificate in the chain proves that the client holds the corresponding key. An attacker appends the public certificate of a trusted client to a certificate of their own and is accepted as that client. That public certificate is not secret. In MicroCloud, the weak point lies in joining a cluster: anyone who intercepts the certificate of a joining member can log in as that member. The flaw was reported by the Incus project, according to The Hacker News<\/a>.<\/p>\n

What could the consequences be?<\/strong><\/p>\n

The attacker acts as the impersonated client, with access to the cluster and the virtual machines. According to Canonical, if the client is privileged this can result in root access to the host. A prerequisite is network access to the HTTPS API. A standalone LXD installation listens only on a local socket by default, unless an administrator has enabled the network API with core.https_address<\/em>. Clusters, MicroCloud environments and hosts where the API is widely reachable are therefore most at risk. The Ubuntu archive packages of LXD are not affected; the fix is in the snaps.<\/p>\n

What should IT administrators do now?<\/strong><\/p>\n

Update LXD and MicroCloud with sudo snap refresh lxd<\/em> and sudo snap refresh microcloud<\/em>, then check the installed version. Canonical says the LXD releases were still being rolled out from the candidate channel to the stable channel, so a refresh on the stable channel may not yet deliver the patched version straight away. Find out which hosts expose the API over the network and close it off to everything outside your management network until the patch is in place. If you use Incus, move to version 7.6.0.<\/p>\n","protected":false},"excerpt":{"rendered":"

In Canonical LXD and MicroCloud an attacker can log in as a trusted client without a private key. Scoring 10.0, the flaw is patched; no exploitation reported yet.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169504,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-maandag-2-november\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-montag-2-november\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-R.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-R-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"LXD and MicroCloud: critical flaw (CVSS 10.0) lets an attacker log in as a trusted client without a private key. Patches available for all branches.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=122"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/122\/revisions"}],"predecessor-version":[{"id":123,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/122\/revisions\/123"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=122"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}