Critical LXD and MicroCloud Flaw Allows Impersonation Without Private Keys

A critical vulnerability in Canonical’s LXD and MicroCloud orchestration tools allows attackers to impersonate trusted clients without possessing their private keys.

The flaw has been assigned a CVSS score of 10.0, representing the highest level of severity. To exploit the vulnerability, an attacker must have network access to the system’s HTTPS API and obtain the public certificate belonging to the trusted client. Once these conditions are met, the attacker can assume the identity of the client, gaining unauthorised access to the management cluster and its hosted virtual machines.

Impact on Cloud Orchestration

LXD is a widely utilised container and virtual machine manager, while MicroCloud is used to manage distributed clusters. Because the flaw allows an attacker to bypass the need for a private key—a fundamental component of secure authentication—it provides a direct path to full cluster compromise.

An attacker successfully impersonating a client can perform administrative actions, potentially accessing sensitive data or disrupting services across all virtual machines and containers within the affected environment.

Mitigation and Response

Organisations utilising LXD or MicroCloud should immediately check for security updates from Canonical. Applying the latest software patches is the most effective way to remediate this impersonation risk and ensure that authentication requires valid private keys.