Critical · 1 source · latest 1d

Critical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation

CRITICAL · VULNERABILITYCanonicalredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

A CVSS 10.0 authentication bypass in Canonical LXD and MicroCloud allows an attacker to log in as a trusted client without its private key. Exploitation requires network reach to the HTTPS API and possession of the target client's public certificate, and the attacker then gains that client's access to the cluster and its VMs. The article is truncated and gives no CVE identifier, affected versions or fixed versions, so verify these against vendor advisories before assessing exposure.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check whether LXD or MicroCloud is deployed and whether its HTTPS API is reachable from untrusted networks.
Review Canonical's advisory for affected versions and apply the vendor fix once you have confirmed it.

Written by AI from the sources, checked against them

Read the full story at the source