A critical certificate validation flaw in LXD and Incus could let remote attackers bypass login checks and take control of clusters and managed virtual machines.

The weakness affects the HTTPS management listener, placing exposed Linux systems at risk without requiring a password, stolen private key, or user interaction. Incus rates its flaw critical, with a CVSS score of 10.0.

The Incus security advisory, published on October 29, says the bug has existed since the project’s initial release. Canonical published its related LXD record, CVE-2026-112816, on October 30. Although Ubuntu assigns that record Medium priority, it describes an unauthenticated path to full cluster and virtual machine access.

Certificate Validation Flaw in LXD and Incus

The problem lies in how the service checks certificates presented during an HTTPS connection. The TLS handshake proves that a client holds the private key for the first certificate it submits. However, the remaining certificates in that chain are controlled by the client and are not verified.

Authentication checks then compare every certificate in the submitted chain against the server’s trust store. This creates a gap between proving ownership of a certificate and accepting its identity. An attacker can append a trusted certificate’s public part to their own chain and be accepted as its owner, despite lacking the matching private key.

Public certificates are not secrets. Servers return their certificates during TLS handshakes, meaning an attacker needs no existing account to obtain one. According to the advisory, presenting the server’s own certificate grants database gateway access, while presenting another cluster member’s certificate grants internal cluster access and bypasses authorization entirely.

This differs from the container escape flaws covered in Cyber Security News’ runc vulnerability report. Rather than breaking out of an isolated workload, this bug targets the trusted management layer that controls access to the environment.

The Incus advisory says attackers can impersonate trusted client, metrics, or server certificates when they have the relevant public certificate. The same weakness allows renewal or deletion of trust store entries through self-service paths. It also affects authentication for the agent connection between hosts and virtual machines.

Another affected area is the authorization scriptlet, a script used to make access decisions. Incus passed the unverified certificate chain to this script, allowing attacker-chosen certificates to influence its decisions. This also affects connections using tokens or OpenID Connect, because those clients can still present certificates during the handshake.

Fixed Versions and Immediate Protection

Incus lists versions before 7.6.0 as affected and version 7.6.0 onward as patched. Canonical’s LXD notice identifies fixes in versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1 for the affected release branches. Administrators should check their installed version against the relevant vendor advisory.

Until updates are applied, Incus advises restricting HTTPS listener access to trusted hosts. There is no configuration-based workaround that fixes the underlying validation error. Network restrictions reduce exposure but do not replace patching.

Cyber Security News’ Linux container security guide provides broader context on protecting container environments. For this flaw, the immediate focus is narrower: update affected services and limit who can reach their management interfaces. Neither cited advisory reports active exploitation, so exposure should not be confused with confirmed compromise.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Critical Certificate Validation Flaw in LXD and Incus Could Give Hackers Control of Linux Hosts appeared first on Cyber Security News.