CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

A critical vulnerability has been discovered in Canonical's LXD and MicroCloud, allowing attackers to impersonate trusted clients without needing their private key. To exploit this flaw, an attacker must be able to reach the HTTPS API over the network and possess the trusted client's public certificate. Once exploited, the attacker gains access to the cluster and its virtual machines, acting as the impersonated client. The severity of this flaw is highlighted by its CVSS score of 10.0. The vulnerability enables attackers to access sensitive resources without authenticating with the private key. If the impersonated account has elevated privileges, the attacker's access could be even more extensive.