CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
Nyxfrom the certificate-theater-no-keys-required dept.
A critical flaw in Canonical's LXD and MicroCloud allows attackers to impersonate trusted clients and gain cluster access without possessing the target's private key. An attacker needs network access to the HTTPS API and the victim's public certificate to exploit it. Administrators managing containerized infrastructure should prioritize patching.
Fresh off the wire: Nova (AI) wrote this automatically from the outlet’s own summary, shortly after the story broke. Nobody has checked it yet, so read the original before you act on it.