Canonical LXD e MicroCloud · Disclosed

CVSS 10.0 LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients

Nov 01, 2026 · 1 min read

A critical CVSS 10.0 flaw in Canonical's LXD and MicroCloud lets an attacker log in as a trusted client without the private key. The attacker must reach the HTTPS API over the network and hold the trusted client's public certificate; once in, they act as that client, with access to the cluster and its virtual machines. The source mentions no fix or active exploitation; restrict network access to the HTTPS API.

By HIFY Radar newsroom Updated 11/01/2026 06:39 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A critical flaw (CVSS 10.0) in Canonical's LXD and MicroCloud lets an attacker log in as a trusted client without that client's private key. Once in, the attacker acts as that client, with access to the cluster and its virtual machines.

Why it matters

If the LXD or MicroCloud HTTPS API is reachable over the network, anyone holding a client's public certificate gains that client's access: the cluster and its virtual machines. Private cloud and virtualization environments using these products are exposed.

What to do

Restrict who can reach the LXD and MicroCloud HTTPS API on the network, via firewall or an isolated network. Review registered trusted clients and track Canonical's fix.

For the technical team

Affected: Canonical LXD e MicroCloud · Canonical LXD and MicroCloud. Versions not stated in the source.
Exploitation: Disclosed only. The source (The Hacker News) reports no active exploitation or public proof of concept.
Fix: Not stated in the source.
Vector: Client authentication on the LXD and MicroCloud HTTPS API. The flaw allows logging in as a trusted client without the private key. Exploitation conditions: reach the HTTPS API over the network and hold the trusted client's public certificate.
More details: Severity CVSS 10.0 per The Hacker News. Once in, the attacker acts as the impersonated client, with access to the cluster and its virtual machines.