CVSS 10.0 flaw in LXD and MicroCloud let attackers impersonate trusted clients
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without that client's private key, gaining access to the cluster and its virtual machines.
Key points
- A critical flaw (CVSS 10.0) affected Canonical’s LXD and MicroCloud.
- An attacker could log in as a trusted client without holding that client’s private key.
- Exploitation required network access to the HTTPS API and the trusted client’s public certificate. Success granted access to the cluster and its virtual machines.
A critical security flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. The flaw carries a CVSS score of 10.0, the maximum rating.
Details
To exploit the flaw, the attacker had to meet two conditions: reach the HTTPS API over the network and hold the trusted client’s public certificate. With those, the attacker could authenticate as that client despite not having the matching private key.
Once in, the attacker acted as that trusted client, with access to the cluster and its virtual machines.
Why it matters
For teams running LXD or MicroCloud, the HTTPS API is the trust boundary. Anyone who could reach it and obtain a client’s public certificate could take over that client’s identity and reach its virtual machines.
What to do
- Follow Canonical’s advisories and update LXD and MicroCloud when a fixed version ships.
- Restrict network access to the HTTPS API so only trusted hosts can reach it.
- Review client certificates and cluster audit logs for unexpected authentications.