External risk intelligence

LXD HTTPS Listener Improper Certificate Validation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-112816

LXD is a system container and virtual machine manager typically deployed on internal infrastructure or private clouds for management purposes. While the HTTPS listener is a network service, it is generally intended for administrative access within a managed environment rather than being exposed directly to the public internet.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated attacker can exploit a vulnerability in Canonical's LXD HTTPS listener to impersonate any trusted client, gaining complete control over the cluster and managed virtual machines. This issue arises from improper certificate validation, allowing a crafted certificate chain to grant broad access.

Unauthorized access to LXD clusters and VMs.
Confirms core infrastructure management security.
Assess LXD exposure and impact.

Attack Path

How an attacker could exploit the issue

An attacker could potentially gain unauthorized access to a trusted client's full cluster and virtual machine data. This is achievable by exploiting a flaw in how the system validates security certificates used for its HTTPS listener. By presenting a specially crafted certificate chain, an attacker could bypass authentication and assume the identity of any trusted client.

No authentication needed.
Crafted certificate chain.
Full cluster and VM access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to impersonate any trusted client, potentially leading to unauthorized access and control over the LXD cluster and any virtual machines or containers it manages. This occurs when the HTTPS listener's certificate validation is improperly handled, enabling the attacker to establish a trusted connection using a crafted certificate chain.

LXD cluster and managed virtual machines.
Attacker uses crafted certificate chain.
Full access to cluster and VMs.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Canonical LXD, a system container and virtual machine manager. Infrastructure and platform teams are likely responsible for managing LXD deployments. The first practical step is to identify all LXD instances, determine their reachability and criticality, and confirm ownership before planning remediation.

Infrastructure and platform teams own this.
Verify LXD instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Canonical LXD?

Canonical LXD is a system-level container and virtual machine manager. It allows administrators to deploy, manage, and scale Linux-based virtual environments. It is frequently utilized in private cloud environments to orchestrate infrastructure resources and provide isolated instances for various workloads.

How does CVE-2026-112816 work?

This vulnerability is classified as improper certificate validation (CWE-295). It occurs when the HTTPS listener in LXD incorrectly verifies the cryptographic certificates presented during a connection. Because the validation logic is flawed, an attacker can supply a specially crafted certificate chain that the software mistakenly accepts as legitimate, allowing them to bypass identity checks entirely.

Do I need to be authenticated to trigger this?

No, authentication is not required. The flaw exists within the listener's initial handshake process, meaning an attacker does not need prior access to the system to initiate the exploit. However, the attack relies on the ability to present a forged certificate chain to the HTTPS listener; it cannot be triggered through simple network traffic that lacks this specific malicious structure.

Is my LXD instance at risk?

Halo Surface Signal indicates that LXD is typically deployed on internal infrastructure or private clouds rather than the public internet. While the HTTPS listener is a network service, it is generally intended for restricted administrative access. You should evaluate if your LXD instances are reachable from untrusted network segments, as this increases the likelihood of unauthorized exploitation.

What is the first step to address this?

Begin by creating a comprehensive inventory of all LXD instances within your environment. Once identified, verify which instances are reachable over the network and confirm their administrative ownership. This will allow your infrastructure and platform teams to prioritize patching efforts based on the specific risk profile of each managed cluster.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.