November 2, 2026
- CVE-2026-112816 (CVSS 10.0) lets an attacker authenticate to LXD and MicroCloud as any trusted client without its private key. The server compared every certificate in the presented chain against its trust store, but mTLS only proves ownership of the leaf — so attaching a trusted client's public certificate behind your own is enough. Requires network reach to the HTTPS API (off by default on standalone LXD) and the target's public cert; MicroCloud's weak point is capturing a member's certificate as it joins the cluster. Reported by the Incus project (fixed in 7.6.0), fixes ship as snaps, no workaround. CISA's October 30 assessment: not known exploited, no public exploit (The Hacker News). · Cloud & Identity