This LXD Flaw Lets Attackers Walk In as Trusted Clients

Robert Moore · 2026-11-01

Imagine someone getting into your server cluster using a key they never actually had. That's essentially what happened with a critical vulnerability in Canonical's LXD and MicroCloud. The flaw earned a CVSS score of 10.0 — the highest severity rating there is — and it's the kind of thing that should make anyone running these tools sit up and pay attention. So what's actually going on here? ### The Short Version An attacker could log in as a trusted client without holding that client's private key. Let that sink in for a second. Authentication is supposed to be the one wall that holds, and this flaw let someone stroll right past it. To pull it off, two conditions had to line up: - The attacker needed network access to the HTTPS API - They needed the trusted client's public certificate That's it. No private key required. Once inside, the attacker could act as that client, with full access to the cluster and its virtual machines. ### Why This Matters More Than It Sounds Public certificates aren't exactly state secrets. They're shared, they're stored in configs, and they sometimes end up in places you'd rather they didn't. Treating a public cert as enough to prove identity is a bit like letting someone into your house because they know what your front door looks like. The real damage depends on who gets impersonated. If the compromised account has broad permissions, an attacker could potentially spin up, modify, or tear down virtual machines across the cluster. In a shared or production environment, that's a serious headache. ### What You Should Actually Do If you're running LXD or MicroCloud, don't wait around. Here's the practical side of things: - Patch to the latest version Canonical has released for this issue - Review which clients are marked as trusted and trim the list - Lock down network access to the HTTPS API so it isn't exposed more widely than necessary - Audit your cluster for anything unusual, especially new or changed VMs > A public certificate proves who someone claims to be. It was never supposed to prove who they are. ### The Bigger Lesson This isn't just about one bug. It's a reminder that authentication logic deserves constant scrutiny, especially in tools that manage infrastructure. A single misstep in how identity gets verified can hand over the keys to everything behind it. And honestly, that's the uncomfortable part. The most dangerous flaws aren't always the loud, obvious ones. Sometimes they're quiet logic gaps that let someone slip in wearing a name badge they printed themselves. If you manage clusters, take this one seriously. Patch it, tighten your trusted client list, and double-check who can reach that API. Your future self will thank you.