Critical CVSS 10.0 flaw in Canonical's LXD and MicroCloud allows client impersonation

· Cybersecurity

A critical flaw rated CVSS 10.0 in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To exploit it, the attacker needed network reach to the HTTPS API and the trusted client's public certificate. Once inside, the attacker could act as that client with access to its resources. The vulnerability matters to organizations running containerized and cloud infrastructure, where LXD and MicroCloud are used to manage virtual machines, containers and clusters. Because the flaw undermines a core authentication assumption, users should apply Canonical's fix and restrict API exposure to trusted networks while reviewing which certificates are trusted.

Why it matters：A maximum-severity flaw in widely used container and cloud management tooling undermines certificate-based authentication, putting self-hosted infrastructure and private clouds at risk.

Key points

  • The flaw is rated CVSS 10.0 and affects Canonical's LXD and MicroCloud.
  • Exploitation requires network access to the HTTPS API and the trusted client's public certificate.
  • Attackers could act as a trusted client without its private key.

Sources (original reporting)

More stories from this day