Critical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation
CRITICAL · VULNERABILITYCanonicalredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
Canonical's LXD and MicroCloud contain a critical flaw, rated CVSS 10.0, that allows authentication as a trusted client without its private key. An attacker needs network access to the HTTPS API and the target client's public certificate. Once authenticated, they act as that client with access to the cluster and its virtual machines.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether LXD or MicroCloud is deployed and whether its HTTPS API is reachable from untrusted networks.
- Review Canonical's advisory for affected versions and apply the vendor fix once you have confirmed it.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Companies