Canonical releases fixes for LXD and MicroCloud client impersonation flaw

Image: Primary

Published Sunday, November 1, 2026 · 5:06 AM EST

Canonical has released fixes for a flaw in LXD and MicroCloud that lets attackers impersonate trusted clients without their private keys, The Hacker News reported. CVE-2026-112816 carries a CVSS score of 10.0; impersonating a privileged client could give an attacker root access to the host. The server checked every certificate presented against its trusted identities, although the connection proved possession of only the first certificate's private key. Attackers could attach a trusted public certificate behind their own to gain access. Exploitation requires network access to the HTTPS API and a trusted client's public certificate. Standalone LXD does not expose that API by default. Canonical said fixed LXD releases were still moving from candidate to stable channels when it issued its advisory.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

AI Capital

Lumaril raises $66 million for industrial AI software

Lumaril raised a $66 million Series A at a $400 million valuation, The Wall Street Journal reported. The company develops AI software that connects to manufacturers' existing control systems to optimize industrial production on factory floors.

AI Science

Harvard smartphone navigation app reduces collisions in 14-person test

Harvard researchers reported that 14 test subjects using their Mobilio smartphone app with a cane reached destinations 13% faster and had 41% fewer indoor collisions than people using a cane with Google Maps. The findings appear in Nature Biomedical Engineering.

Security

NetamLoader disclosure exposes attack on government Windows systems in Asia

Kaspersky has disclosed a previously undocumented malware framework called NetamLoader targeting a custom Windows 10 build used exclusively by government entities in Asia.

Security

Binance plans phased withdrawal restart after hack

Binance says it plans to resume withdrawals in phases starting Sunday after covering 95% of the $6.3 billion in tokens stolen in a hack, Reuters reports. The stolen tokens included BTC and ETH. The planned restart would restore withdrawal access in stages.

Capital

NeuroXess raises RMB 700 million for brain-computer interfaces

Shanghai-based NeuroXess raised RMB 700 million in Series B funding, TechNode reported. SDIC Juli, Shenzhen Capital Group and Qinzhi Capital co-led the round.

Infrastructure Security

Firezone releases Rust WireGuard library supporting parallel encryption

Firezone has released sanstun, an Apache 2.0-licensed Rust implementation of WireGuard available on crates.io. The library separates network operations, time and randomness from protocol state, giving applications control over those operations.