Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 10.0 · canonicalNVD modified 2026-10-30 16:42
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4 vendor-advisory
- https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557 vendor-advisory
- https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024 release-notes
- https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1 release-notes
- https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1 release-notes
- https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571 release-notes