Canonical LXD certificate validation flaw allows unauthenticated access (EUVD-2026-114194)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Canonical
- Product
- LXD
- First seen
Summary
The EU Vulnerability Database lists improper certificate validation in the HTTPS listener of Canonical LXD, scored 10.0 (CVSS v3.1). The listing says an unauthenticated attacker could authenticate as any trusted client and gain full access, and names fixed versions 4.0.15, 5.0.11, 5.21.9 and 6.10.1.
If you use Canonical
Upgrade LXD to 4.0.15, 5.0.11, 5.21.9, 6.10.1 or later, matching your release branch
Limit exposure of the LXD HTTPS listener to trusted networks until patched
Review the list of trusted clients for unexpected entries
What the sources say 1
· Mastodon: “Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the...” Source