What Happened
Canonical and the Incus project disclosed CVE-2026-112816, a CVSS 10.0 flaw in LXD and MicroCloud, according to The Hacker News. An attacker logs in as a trusted client without holding its private key. If the impersonated client has privileges, Canonical warns of root access to the host machine.
The flaw affects LXD 4.0.14, 5.0.10, 5.21.8, and 6.9, each before its fixed release, plus MicroCloud. Fixes arrive in LXD 6.10.1, 5.21.9, 5.0.11, and 4.0.15, in MicroCloud 3.4.1 and 2.1.5, and in Incus 7.6.0. A CISA assessment dated October 30 found no known exploitation. The flaw is not in the KEV catalog and no working exploit is public.
Why This Matters for Canadian Organizations
LXD and MicroCloud run private clouds, lab clusters, and container hosts. Canadian universities, hosting providers, and enterprise engineering teams use this kind of infrastructure to hold workloads and customer data. A host-level compromise reaches every container and virtual machine on the node, including regulated personal information covered by PIPEDA.
The timing matters. Maximum-severity flaws attract exploit developers within days of disclosure. Our recent TechTalk analysis of the Oracle E-Business Suite and GitLab flaws shows attackers move fast once details spread. You have a window now. Use it.
What to Do
List every LXD, MicroCloud, and Incus host in your environment, including lab and test clusters. Upgrade to the fixed releases above. Until you finish, restrict network access to the LXD API to management networks only. Review the list of trusted clients and remove any you do not recognize. Audit privileged clients, since root access follows them. Watch logs for unexpected client logins after the upgrade. For daily updates, read our news coverage.
