LXD flaw lets public certificates impersonate trusted clients
Canonical patched a CVSS 10.0 flaw in LXD and MicroCloud that could let an attacker impersonate a trusted client; the Incus project, a community fork of LXD, reported the bug, and Incus is affected too.
The products use mutual TLS, which checks a client certificate to establish identity. The server searched every certificate the client supplied for a trusted one, although TLS proves possession only of the private key matching the first certificate. An attacker with access to the HTTPS API and a trusted client's public certificate could therefore be accepted as that client—without its private key—and inherit its cluster permissions. A privileged identity could give access to host root.
If a cluster's API is reachable, or an attacker can capture a MicroCloud member certificate during joining, that identity's permissions can extend across the cluster and its virtual machines. CISA has not listed the flaw as known exploited, but that does not establish whether a specific exposed cluster was accessed.