Threat Overview
Canonical confirmed CVE-2026-112816 in LXD and MicroCloud HTTPS API mutual-TLS authentication. The server incorrectly compared all certificates supplied in a client chain with its trusted certificate store, even though the TLS handshake only proves possession of the leaf certificate private key. An attacker who can reach the API and obtain a trusted client’s public certificate can place it later in an attacker-controlled chain and be accepted as that client. Depending on the impersonated client’s privileges, this can grant cluster and VM control and potentially root access to a host. Standalone LXD network APIs are disabled by default; MicroCloud cluster operations create relevant network trust relationships.
References
Canonical security advisory — 2026-10-28; fixes 2026-10-29
Ubuntu CVE record — 2026-10-30
The Hacker News coverage — 2026-11-01
Impacted Systems
Vendor/products: Canonical LXD snap 4.0.14, 5.0.10, 5.21.8 and 6.9 and corresponding vulnerable branch builds before 4.0.15, 5.0.11, 5.21.9, 6.10.1; Canonical MicroCloud snap 2/stable and 3/stable before 2.1.5 and 3.4.1. Deployment: self-managed Linux LXD virtualization/containers and MicroCloud clusters. Role: LXD HTTPS API listener (often TCP 8443 when enabled; configurable), MicroCloud cluster API. Prerequisites: network access to the API and public certificate of a trusted client or joining cluster member. Fixed snap versions released 2026-10-29: LXD 4.0.15 / 5.0.11 / 5.21.9 / 6.10.1, MicroCloud 2.1.5 / 3.4.1. Ubuntu archive LXD packages listed not affected or not shipped. Incus fork independently fixed in 7.6.0.
Why this matters
CVSS 10.0 authorization impact on Linux virtualization hosts and clusters, but the network API is not enabled by default on standalone LXD and exploitation has not been confirmed.
Exploitation Status
Vendor-confirmed critical vulnerability, fixed October 29. As of November 2 reporting, no confirmed in-the-wild exploitation or published working exploit was identified. Treat any authentication/network hunt as exposure or post-compromise investigation, not proof of CVE exploitation.
Observed activity / IOCs and caveats: No confirmed attacker TTPs or IOCs are published for this CVE. Expected risk outcomes include authenticated API actions under another client identity, unauthorized instance creation/exec, trust changes or cluster operations. These are analytic hypotheses, not observed exploitation artifacts. Hunt results must be correlated to actual LXD API configuration and host/cluster inventory.
What this hunt looks for
A remotely reachable virtualization control plane with weak certificate-chain validation can turn public certificate material into administrative access. However, the exposure condition is narrower than a general Internet-facing RCE because network API access and a trusted public certificate are prerequisites.
Required logs
DeviceFileEvents; DeviceNetworkEvents; DeviceProcessEvents; Syslog — only where ingested into Microsoft Sentinel. No customer workspace was queried.
L01 — LXD/MicroCloud trust and authentication events
Required: Syslog.
Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has_any ('lxd','microcloud') or SyslogMessage has_any ('lxd','microcloud')
| where SyslogMessage has_any ('certificate','trust','authentication','client','cluster','join','api')
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated descL02 — LXD client trust additions or certificate modifications
Required: DeviceProcessEvents.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine has_any ('lxc config trust','lxc trust','lxd init','microcloud init','microcloud join')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descL03 — LXD API network access to typical HTTPS listener
Required: DeviceNetworkEvents.
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where LocalPort == 8443 or RemotePort == 8443
| where InitiatingProcessFileName has_any ('lxd','microcloud','lxc') or InitiatingProcessCommandLine has_any ('lxd','microcloud','lxc')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, LocalIP, LocalPort, RemoteIP, RemotePort, ActionType
| order by TimeGenerated descL04 — New external peers reaching local HTTPS API port
Required: DeviceNetworkEvents.
let OldPeers = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where LocalPort == 8443 and isnotempty(RemoteIP)
| summarize by DeviceId, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated >= ago(2d)
| where LocalPort == 8443 and isnotempty(RemoteIP)
| join kind=leftanti OldPeers on DeviceId, RemoteIP
| project TimeGenerated, DeviceName, LocalIP, LocalPort, RemoteIP, InitiatingProcessFileName, ActionType
| order by TimeGenerated descL05 — LXD daemon spawning shell or host administration tools
Required: DeviceProcessEvents.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName has_any ('lxd','microcloud')
| where FileName in~ ('bash','sh','dash','sudo','curl','wget','python3','nc','socat')
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated descL06 — Sensitive LXD state or trust file changes
Required: DeviceFileEvents.
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any ('/var/snap/lxd/','/var/lib/lxd/','/var/snap/microcloud/')
| where FileName has_any ('trust','certificate','client','config','server')
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descL07 — LXD instance or cluster changes recorded in system logs
Required: Syslog.
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ('lxd','microcloud')
| where SyslogMessage has_any ('instance','cluster','trust','certificate','exec','create','delete','migration')
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated descDetection Notes
No public exploit-specific signatures or IOCs. L01/L07 rely on LXD/MicroCloud daemon logs actually forwarded to Syslog. L03/L04 use typical port 8443, but the listener can be disabled or moved to a custom port; generic 8443 hits are not exploit evidence. L02/L05/L06 require Defender endpoint telemetry on Linux hosts. TLS client certificate chains are usually not visible in standard Sentinel firewall logs; without reverse-proxy TLS inspection or server authentication logs, the bypass itself may be invisible. Do not interpret an empty result as proof of no exploitation.
Scope: conclusions are limited to Sentinel-ingested data and retention. No customer-specific finding is asserted.
