Affected Systems
Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9 (and earlier in each branch); MicroCloud 2.x and 3.x. Only affects installations with network-exposed HTTPS API (core.https_address enabled for LXD, or MicroCloud cluster deployments). Ubuntu archive packages not affected; snap packages are the vulnerable distribution channel.
Exploitation Status
No known active exploitation. CISA assessed as not exploited as of October 30, 2026. No public PoC available. Theoretical attack requires network access to HTTPS API and possession of a trusted client's public certificate.
Business Impact
Attackers with network access to the LXD/MicroCloud HTTPS API and a trusted client's public certificate can authenticate as that client without the private key, due to improper TLS certificate chain validation. Successful exploitation grants full cluster access and control over virtual machines. If the impersonated client has elevated privileges, attackers can achieve root access on the host. MicroCloud clusters are particularly vulnerable during member join operations when certificates may be intercepted. Standalone LXD servers with default configuration (local socket only) are not exposed.
Urgency
🟠Within 24 hours
Recommended Actions
- Update LXD snap packages immediately: run 'sudo snap refresh lxd' and verify version is 6.10.1 (6/stable), 5.21.9 (5.21/stable), 5.0.11 (5.0/stable), or 4.0.15 (4.0/stable)
- Update MicroCloud snap packages: run 'sudo snap refresh microcloud' and verify version is 3.4.1 (3/stable) or 2.1.5 (2/stable)
- Verify the installed version post-update as fixed releases were rolling from candidate to stable channel at advisory time
- Restrict network access to LXD HTTPS API (core.https_address) using firewall rules or network segmentation until patching is complete
- Audit LXD and MicroCloud access logs for unexpected client certificate usage or authentication from unfamiliar network sources