GHSA-99jp-jwmc-65p4: Improper certificate validation in the HTTPS listener in LXD

Published Oct 30, 2026

Updated

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Event History

Oct 30, 2026

CVE Published

via OSV·04:42 PM

Data Sourced

via OSV·04:42 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need credentials or user interaction to exploit this issue?

No. The issue is described as exploitable by an unauthenticated attacker, with no user interaction required.

What access could an attacker gain after successful exploitation?

An attacker could authenticate as any trusted client and gain full access to the LXD cluster and its managed virtual machines.

Which releases contain the fixes?

The fixed releases are LXD 4.0.15, 5.0.11, 5.21.9, and 6.10.1.

GHSA-99jp-jwmc-65p4: Improper certificate validation in the HTTPS listener in LXD

Event History

Frequently Asked Questions

Does an attacker need credentials or user interaction to exploit this issue?

What access could an attacker gain after successful exploitation?

Which releases contain the fixes?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need credentials or user interaction to exploit this issue?

What access could an attacker gain after successful exploitation?

Which releases contain the fixes?