Critical · 1 source · latest 2d

Critical certificate-validation flaws in Incus and LXD allow unauthenticated cluster takeover

CRITICAL · VULNERABILITYIncusredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

Critical certificate-validation vulnerabilities in Incus and Canonical LXD let unauthenticated attackers with network access to the HTTPS listener impersonate trusted identities. Exploitation does not need valid credentials or the private key of a trusted certificate, and the LXD flaw may expose entire clusters.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check vendor advisories for Incus and LXD and apply the fixed versions once they are confirmed.
Restrict network access to the HTTPS management listener to trusted hosts only.

Written by AI from the sources, checked against them

Read the full story at the source