Critical LXD and MicroCloud Vulnerability Lets Hackers Masquerade as Trusted Clients

A newly disclosed vulnerability in Canonical's container manager LXD and its orchestration tool MicroCloud has earned a perfect CVSS 10.0 score, indicating the highest possible severity. The flaw enables an attacker who can reach the services' HTTPS API to authenticate as any trusted client without possessing the client’s private key, provided the public certificate is known.

The issue stems from a logic error in the way LXD and MicroCloud validate client identities during TLS handshakes. By manipulating the authentication flow, a malicious actor can present a forged request that the server accepts as coming from a legitimate client, effectively bypassing cryptographic protections that normally require the private key.

Exploitation requires two conditions: network access to the vulnerable API endpoint and possession of the target client’s public certificate, which is often obtainable from prior communications or public repositories. Once these prerequisites are met, the attacker can execute privileged operations, including container creation, configuration changes, and potentially full system compromise on the host running LXD or MicroCloud.

Canonical has acknowledged the defect and released patches for affected versions of LXD and MicroCloud. The company advises administrators to apply the updates immediately, restrict API exposure to trusted networks, and employ additional network‑level controls such as firewalls and mutual TLS where feasible. Users are also urged to rotate certificates after patching to eliminate any remnants of compromised trust relationships.

The discovery highlights the broader risk associated with exposing management APIs over the internet without robust access controls. Security researchers emphasize that even well‑designed cryptographic systems can be undermined by implementation flaws, underscoring the need for rigorous code review and continuous vulnerability scanning in cloud‑native environments.