CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

A critical flaw in Canonical’s LXD and MicroCloud, rated CVSS 10.0, lets an attacker log in as a trusted client without holding that client’s private key, The Hacker News reports. The attacker needs network access to the HTTPS API and the trusted client’s public certificate, and impersonation gives access to the cluster and its virtual machines.