Security AlertCritical
Critical LXD flaw lets attackers impersonate trusted clients
Nov 1, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Canonical fixed a CVSS 10.0 flaw in LXD and MicroCloud that could let an attacker log in as a trusted client without its private key. Update to the fixed snap releases.
Key points
- Attackers needed network access to the HTTPS API and a trusted public certificate.
- A successful login could expose clusters and virtual machines.
- Canonical says fixed snap versions are available for LXD and MicroCloud.
Why it matters
If you run LXD or MicroCloud, this could let someone act as a trusted system user. That raises the risk of host access and exposure of virtual machines. Patching quickly matters, especially if your API is reachable over the network.
Who’s affected: LXD and MicroCloud users
What to do
- Refresh LXD and MicroCloud snaps now.
- Verify the installed version after updating.
- Limit network access to the API until patched.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.