Critical LXD and MicroCloud Flaw Exposes Clusters to Unauthorized Access
A newly discovered vulnerability allows attackers to impersonate trusted clients without private keys. This could lead to full cluster compromise and unauthorized VM access.
TL;DR
- CVSS 10.0 rated flaw affects Canonical's LXD and MicroCloud platforms
- Attackers can bypass authentication using only a client's public certificate
- Exploitation requires network access to the HTTPS API endpoint
- Successful attacks grant full cluster access and VM control
- Organizations should audit certificate-based access immediately
A critical security flaw has been identified in Canonical's LXD and MicroCloud infrastructure platforms, earning a perfect CVSS score of 10.0. The vulnerability allows malicious actors to authenticate as trusted clients without possessing their corresponding private keys, potentially granting unauthorized access to entire clusters and their associated virtual machines.
The attack vector relies on the attacker having network access to the HTTPS API and possession of a legitimate client's public certificate. Once exploited, the attacker gains the full privileges of the impersonated client, including access to cluster resources and virtual machine environments. This represents a severe risk to organizations relying on these platforms for container and cloud orchestration.
Vulnerability Details
- The flaw enables authentication bypass by exploiting certificate-based trust mechanisms
- No private key possession required for successful impersonation attacks
- Perfect CVSS 10.0 score indicates maximum severity with no mitigating factors
- Affects both LXD container management and MicroCloud orchestration platforms
Impact and Recommendations
- Attackers gain full cluster access and can control all associated virtual machines
- Organizations should immediately audit certificate-based authentication configurations
- Network segmentation and API access controls can help limit exploitation scope
- Canonical has released patches - immediate update recommended for all deployments
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.