# Canonical releases fixes for LXD and MicroCloud client impersonation flaw

_Published Sunday, November 1, 2026 at 5:06 AM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

![Canonical releases fixes for LXD and MicroCloud client impersonation flaw — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4Vibbj3miGalyf0avn_Z2WlLhFh5cC5ImXGFlOL0cisgxikHCcLzHjOVM3qO5B47V3uw62rWH6m6fP1svsH3TCG6i9sS19BIXn1CsDjKK3gnG6VQxkFwghemdeBlV4_AM5Ah-_TJ3T_5Gv-D5Pygrm-B5yzQnDqvIXmI2FyAeuzk57_l6esdhNrTMBj0/s1700-nu-rw-lo-l85-e365/linux-vm.jpg)

Canonical has released fixes for a flaw in LXD and MicroCloud that lets attackers impersonate trusted clients without their private keys, The Hacker News reported. CVE-2026-112816 carries a CVSS score of 10.0; impersonating a privileged client could give an attacker root access to the host.

The server checked every certificate presented against its trusted identities, although the connection proved possession of only the first certificate's private key. Attackers could attach a trusted public certificate behind their own to gain access.

Exploitation requires network access to the HTTPS API and a trusted client's public certificate. Standalone LXD does not expose that API by default. Canonical said fixed LXD releases were still moving from candidate to stable channels when it issued its advisory.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html)

---
Canonical: https://techandbusiness.org/newswire/DG3FFkMOXj7_5kT20RF2IA
Published: 2026-11-01T10:06:08.269Z
Story chronology: 2026-11-01T08:51:00.000Z
Retrieved: 2026-11-01T13:05:47.169Z
Publisher: Tech & Business (techandbusiness.org)