Canonical LXD and MicroCloud Client Impersonation Flaw

# Canonical LXD and MicroCloud Client Impersonation Flaw

https://gcdradar.vercel.app/incidents/canonical-lxd-and-microcloud-client-impersonation-flaw · AIR-2026-1702 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical vendor rating with fixed release available.
- Fix status: Patched
- First reported: 2026-11-01
- AI role: No AI role
- Products: LXD, MicroCloud
- CVSS: 10

## Summary

A critical authentication bypass flaw in Canonical LXD and MicroCloud allows attackers to impersonate trusted clients using their public certificates. Successful exploitation grants attackers full cluster and virtual machine access.

## What to do

Update LXD and MicroCloud to the latest fixed versions.

## Latest updates

- 2026-11-01: CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key (https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html)

## Sources

- 2026-11-01 The Hacker News: CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.