LXD and MicroCloud Certificate Bypass: What Administrators Should Check Now

A client certificate is supposed to prove more than an identity printed on a certificate. It is supposed to prove that the connecting client has the corresponding private key. That’s the trust boundary at the center of Canonical’s October 28 security advisory for LXD and MicroCloud.The issue, CVE-2026-112816, lets someone who can reach the affected HTTPS API authenticate as a trusted client by supplying that client’s public certificate in a crafted certificate chain. The attacker does not need the corresponding private key. Depending on the privileges of the impersonated client, that can mean control of managed containers and virtual machines, or even root access to the host.That is serious, but it is not a reason to declare every Ubuntu server compromised. The actual exposure depends on the deployment and what its management interface allows.What failed in certificate authenticationLXD supports mutual TLS for remote management. In a correct client-authentication check, the server…