According to The Hacker News, a critical flaw in Canonical’s LXD and MicroCloud platforms allows an attacker to log in as a trusted client without possessing that client’s private key. The vulnerability requires the attacker to reach the system via the HTTPS API over a network connection and already possess the trusted client’s public certificate.
With successful exploitation, the attacker can assume the identity of the impersonated client, thereby gaining access to the cluster environment and its associated virtual machines. The ability to act as the trusted client grants control consistent with what that client normally has within the cluster.
The flaw centers on authentication mechanisms in LXD and MicroCloud when interacting through their HTTPS APIs under network reachability conditions where the public certificate of a trusted client is available to an external party. No additional keys, tokens, or secret material are required for the impersonation to proceed once these two conditions—network access to the API and possession of the public certificate—are met.
