Critical CVSS 10.0 Flaw in Canonical LXD and MicroCloud Allows Client Impersonation Without a Private Key

What happened

A critical vulnerability rated CVSS 10.0 was reported in Canonical's LXD and MicroCloud. According to the report, an attacker could authenticate as a trusted client over the HTTPS API without possessing that client's private key. The attacker only needed network access to the API and the trusted client's public certificate.

Once authenticated, the attacker would operate with the impersonated client's permissions, gaining access to the cluster and its virtual machines.

Why it matters for defenders

LXD and MicroCloud are used to run container and VM clusters, often for infrastructure that hosts other workloads. A flaw that lets an attacker bypass private-key possession while impersonating a trusted identity undermines the core trust model of mutual TLS client authentication. If the impersonated client holds elevated privileges, the attacker effectively inherits cluster-admin-level control over hosted VMs. That is a significant blast radius for any organization running LXD or MicroCloud clusters.

What defenders should watch for or do now

• Apply vendor patches for LXD and MicroCloud as soon as they are available, and track Canonical's advisories closely given the CVSS 10.0 severity.
• Review exposure of the LXD and MicroCloud HTTPS API. Restrict network reachability to trusted management networks only, since the report specifies network access to the API as a prerequisite.
• Audit how trusted client certificates are distributed and stored. Since the public certificate alone was reportedly sufficient for impersonation, treat certificate handling and any certificate-exchange workflows as sensitive.
• Hunt for anomalous authentications or API actions from client identities that do not match expected source hosts or usage patterns, and review cluster and VM access logs for unexpected trusted-client activity.
• Rotate or re-issue client certificates for trusted identities with cluster-wide or VM-admin privileges if compromise cannot be ruled out.

Developing story

Details here are based on an initial public report, and the full summary was truncated in our source feed. Technical specifics such as affected version ranges, patch status, and a CVE identifier were not available at the time of writing. This is net-new intel without a formal CVE tracked yet in our platform. Check back for updates, and see the original reporting at The Hacker News.