Description

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Related CPE's

Could not find any relations

References

https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571

https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1

https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1

https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024

https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557

https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4

Weaknesses

[email protected]

Secondary
CWE-295

CVSS impact metrics

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

10 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-30T17:17:14.293Z

1 hour ago

Last modified

2026-10-30T18:17:21.363Z

29 minutes ago