CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
Summary
A critical vulnerability in Canonical's LXD and MicroCloud allows attackers to impersonate trusted clients by accessing their HTTPS API and possessing the client's public certificate. Successful exploitation grants attackers full access to the cluster and its virtual machines as if they were the legitimate client.
IFF Assessment
This vulnerability allows attackers to impersonate trusted clients, granting them unauthorized access to sensitive resources and virtual machines.
Severity
This vulnerability is rated critical (CVSS 10.0) because it allows attackers to gain complete administrative access (Confidentiality, Integrity, and Availability impacts) without needing authentication credentials or exploiting complex attack vectors, only requiring network access to the API and the victim's public certificate.
Defender Context
This critical flaw highlights the importance of securing API endpoints and managing certificate trust relationships within container orchestration platforms. Defenders should ensure proper network segmentation and strict access controls are in place for LXD and MicroCloud instances. Regular monitoring for unusual API access patterns or certificate misuse is also advised.