LXD and Incus Checked Every Certificate in the Client's Chain Against the Trust Store. Only the First One Proves a Key

Mon, 02 Nov 2026 08:30:00 +0530

LXD’s remote API authenticated clients with mutual TLS and a trust store of pinned client certificates. The server took the certificate chain a client presented, compared every certificate in it against the trust store, and accepted the client if any of them matched. Canonical’s advisory describes the consequence: only the leaf certificate proves possession of a private key, so an attacker can put a trusted client’s public certificate behind their own and be treated as that client. The CVE is CVE-2026-112816 and it is scored 10.0.

Go on Kuldeep Pisda

LXD and Incus Checked Every Certificate in the Client's Chain Against the Trust Store. Only the First One Proves a Key