A CVSS 10.0 flaw in Canonical's LXD and MicroCloud let attackers impersonate trusted clients without a private key. Here's how it worked and what to do.
Picture a locked door where the guard only checks the name on your badge, not whether you actually own it. That's basically what happened with a critical vulnerability in Canonical's LXD and MicroCloud. Security researchers slapped it with a CVSS score of 10.0, the highest severity rating possible. And when a flaw earns that number, it's worth paying attention.
Here's the short version: an attacker could log in as a trusted client without ever holding that client's private key. No stolen credentials, no brute force. Just a clever trick that made the system believe they were someone they weren't.
### How the Impersonation Actually Worked
To pull this off, the attacker needed two things. First, they had to reach the HTTPS API over the network. Second, they needed the trusted client's public certificate. That's it.
Now, a public certificate is, well, public by design. It's meant to be shared. The private key is the part that's supposed to stay secret. So the whole security model rests on the assumption that you can't authenticate without it. This flaw flipped that assumption on its head.
Once inside, the attacker operated as that trusted client. That meant access to the cluster and every virtual machine running on it. Depending on what the impersonated account was allowed to do, the damage could range from annoying to catastrophic.
- Full visibility into the cluster's virtual machines
- The ability to act as a legitimate, trusted client
- Potential access to whatever resources that account could touch
### Why a 10.0 Score Matters
A CVSS score of 10.0 doesn't get handed out lightly. It means the flaw is remotely exploitable, requires little to no privileges, and can seriously compromise confidentiality, integrity, and availability all at once.
> "The scariest vulnerabilities aren't the ones that break in loudly. They're the ones that walk in quietly, wearing someone else's name."
For teams running LXD or MicroCloud in production, that quiet walk-in is the real worry. If an attacker can impersonate a trusted client, your logs might show nothing unusual at all. Everything looks legitimate because, from the system's point of view, it is.
### What This Means for Your Setup
If you're running either platform, don't wait. Canonical has addressed the issue, so patching should be your first move. Beyond that, it's worth rethinking how much trust you hand to any single client certificate.
A few practical steps:
- Apply the latest security updates as soon as you can
- Review which clients hold trusted certificates and trim the list
- Limit network exposure of the HTTPS API where possible
- Audit cluster access logs for anything that looks off
### The Bigger Lesson
This flaw is a good reminder that authentication is only as strong as its weakest check. When a system trusts a name instead of proof of ownership, the whole chain gets shaky. Whether you're running a small home lab or a fleet of clusters, the takeaway is the same: verify, don't assume. And patch fast, because a 10.0 doesn't wait around for a convenient maintenance window.
