Critical CVSS 10.0 Auth Bypass in Canonical LXD & MicroCloud Allows Client Impersonation
What Happened — Canonical disclosed a critical vulnerability (CVSS 10.0) affecting LXD 4.0‑5.0 and MicroCloud 2.0‑2.3. The flaw resides in the HTTPS API handling of client certificates. An attacker who can reach the API endpoint and obtain a victim’s public certificate can authenticate as that client without possessing the private key. Successful exploitation grants full control over the LXD cluster and any hosted virtual machines, effectively bypassing mutual‑TLS authentication. The issue was reported to Canonical on 30 Oct 2026, a patch was released on 5 Nov 2026, and advisory notices have been circulated to affected users.
Why It Matters for Trust & Control Assurance — The vulnerability demonstrates a gap in authentication and certificate‑validation controls; robust identity‑access processes and continuous monitoring are essential to prove compliance with control objectives across frameworks.
Who Is Affected — Cloud‑infrastructure providers, SaaS platforms, and any organization that runs LXD or MicroCloud in production environments.
Recommended Actions
- Apply Canonical’s security patch immediately.
- Rotate all client certificates and revoke any that may have been exposed.
- Enforce strict mutual‑TLS validation and enable certificate‑pinning where possible.
- Deploy continuous monitoring of API authentication logs for anomalous client‑certificate usage.
- Review and harden your certificate‑management procedures to ensure proof of control for audits.
Source: The Hacker News
Technical Notes
- Attack Vector: Exploits a flaw in the HTTPS API handling of public certificates (vulnerability exploit).
- CVSS Base Score: 10.0 (Critical).
- Affected Products: LXD 4.0‑5.0, MicroCloud 2.0‑2.3.
- Data at Risk: Full administrative control of virtual machines and host clusters.
Source: The Hacker News