Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate to their own TLS chain. Fixed in LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1.