As cited
Copy frozen at (site build).
vulnerabilities
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical's LXD and MicroCloud allows an attacker to impersonate a trusted client and authenticate via the application programming interface (API) without possessing the client's private key, requiring only network access to the HTTPS API and the target's public certificate. Successful exploitation grants the attacker the same cluster and virtual machine access as the impersonated account.
Why it matters: Organizations running LXD or MicroCloud clusters need to patch immediately, as any network-adjacent attacker with knowledge of a trusted client's public certificate can assume full administrative control.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical's LXD and MicroCloud allows an attacker to impersonate a trusted client and authenticate via the application programming interface (API) without possessing the client's private key, requiring only network access to the HTTPS API and the target's public certificate. Successful exploitation grants the attacker the same cluster and virtual machine access as the impersonated account.
Why it matters: Organizations running LXD or MicroCloud clusters need to patch immediately, as any network-adjacent attacker with knowledge of a trusted client's public certificate can assume full administrative control.
- Source published
- First seen by Cybersecurity Tracker