CuraSec

tag: Lxd · 2 items

Plan CVSS 10.0 Auth Bypass in Canonical LXD and MicroCloud
2026-11-01 · The Hacker News · source ↗ #authentication-bypass#lxd#container-security
  • Engineer — Plan: Teams running LXD or MicroCloud clusters should prioritize patching — an authentication bypass at CVSS 10.0 could allow cluster takeover and VM access. No KEV listing or public PoC in the enrichment signals, but the attack surface (network-reachable HTTPS API) warrants patching this sprint rather than waiting for a routine cycle.
  • SOC/IR — Skip
  • Leader — Skip
Learn CVE-2026-112816: Canonical LXD CVSS 10.0, no active exploitation
2026-10-31 · HN (cve) · source ↗ #lxd#container-security#critical-cve
  • Engineer — Learn: A perfect-score CVSS on a container/VM hypervisor warrants attention, but EPSS is 0.00, no PoC exists, and the source summary is too thin to confirm patch availability or vulnerability class — monitor Canonical’s advisory for LXD version details before acting.
  • SOC/IR — Skip
  • Leader — Skip
  • Signals: CVE-2026-112816 — CISA KEV: not listed, EPSS 0.00, no public PoC found