Critical · 1 source · latest 2d

Critical certificate-validation flaws in Incus and LXD allow unauthenticated cluster takeover

CRITICAL · VULNERABILITYIncusredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

Critical certificate-validation vulnerabilities affect Incus and Canonical LXD, enabling unauthenticated attackers with network access to the HTTPS listener to impersonate trusted identities without valid credentials or a trusted certificate's private key. The article states the LXD issue may expose entire clusters. The article does not give CVE identifiers, affected version ranges or fixed releases, so defenders should check vendor advisories, restrict access to the LXD/Incus HTTPS API to trusted management networks, and apply vendor patches once confirmed.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check vendor advisories for Incus and LXD and apply the fixed versions once they are confirmed.
Restrict network access to the HTTPS management listener to trusted hosts only.

Written by AI from the sources, checked against them

Read the full story at the source