A critical flaw in Canonical’s LXD and MicroCloud allows attackers to impersonate trusted clients via the HTTPS API without needing the client’s private key. By leveraging a known public certificate, unauthorized actors can gain full access to the cluster and virtual machines with the privileges of the targeted account. Administrators should apply patches immediately.
READ THE ORIGINAL ARTICLE AT THEHACKERNEWS.COM →