Critical LXD and MicroCloud Bug Lets Threat Actors Masquerade as Trusted Clients

A newly disclosed vulnerability in Canonical's container manager LXD and its lightweight cloud orchestration tool MicroCloud has been assigned a perfect CVSS score of 10.0, indicating an extreme level of risk. The flaw enables an adversary to assume the identity of a legitimate client and gain access to the HTTPS API without possessing the client’s private key.

Exploitation hinges on two conditions: the attacker must be able to reach the target's API endpoint over the network and must have a copy of the victim's public certificate. With these elements, the flaw bypasses the standard certificate‑based authentication, allowing the malicious party to issue commands as if they were the trusted client.

The practical consequences are severe for environments that rely on LXD or MicroCloud to host containers, manage workloads, or provide edge‑cloud services. An intruder who successfully impersonates a privileged client could spin up or destroy containers, alter network configurations, or extract sensitive data, potentially compromising entire infrastructures that depend on these tools.

Canonical responded promptly after the issue was reported by The Hacker News, publishing security advisories and releasing patches for affected versions. Users are urged to apply the updates immediately, restrict API exposure to trusted networks, and rotate any certificates that may have been compromised. The company also emphasized the importance of employing additional layers of authentication, such as token‑based mechanisms, to mitigate similar risks in the future.

The incident underscores a broader challenge for open‑source projects that expose management interfaces over the internet. While public‑key infrastructure is a strong security foundation, implementation nuances can create unexpected attack vectors. Experts recommend regular security audits, rigorous certificate handling practices, and defense‑in‑depth strategies to protect critical infrastructure from sophisticated impersonation attacks.