importantSYS.SOURCE: The Hacker News• 2026-11-01T14:21:31+05:30

Critical LXD and MicroCloud Vulnerability Allows Unauthorized Impersonation via Public Certificates

#vulnerability #cloud security #system security

A critical vulnerability in Canonical's LXD and MicroCloud allows attackers to impersonate trusted clients without a private key by exploiting their public certificates. This enables unauthorized access to clusters and virtual machines, posing a significant security risk.

A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate.

Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is

Read original article

*** END OF TRANSMISSION ***

> NORWAY'S SCENIC ROUTES AND AWARD-WINNING PUBLIC TOILETS > UNICODE-BASED DOMAIN NAME SPOOFING TECHNIQUES > PACIFIC ISLAND NATION IMPLEMENTS UNIVERSAL BASIC INCOME PILOT PROGRAM > CRITICAL LXD AND MICROCLOUD VULNERABILITY ALLOWS UNAUTHORIZED IMPERSONATION VIA PUBLIC CERTIFICATES > POLYMARKET PREDICTION MARKET SUFFERS $2.7M THEFT VIA COMPROMISED DEBUGBEAR SCRIPT > FBI ATTRIBUTES $6.43 BILLION BINANCE CRYPTO HEIST TO NORTH KOREA'S TRADERTRAITOR GROUP > ADVANCED NETAMLOADER MALWARE EXPLOITS CUSTOM WINDOWS 10 BUILDS IN ASIAN GOVERNMENT NETWORKS > GOOGLE'S PAC-MAN DOODLE AUTOPLAY SOUND INCIDENT > AI-DRIVEN DEVELOPMENT COSTS IN JAVASCRIPT FRAMEWORKS > DATA CENTERS AND AI EMERGE AS KEY MIDTERM ELECTION ISSUES IN BROOKLYN> NORWAY'S SCENIC ROUTES AND AWARD-WINNING PUBLIC TOILETS > UNICODE-BASED DOMAIN NAME SPOOFING TECHNIQUES > PACIFIC ISLAND NATION IMPLEMENTS UNIVERSAL BASIC INCOME PILOT PROGRAM > CRITICAL LXD AND MICROCLOUD VULNERABILITY ALLOWS UNAUTHORIZED IMPERSONATION VIA PUBLIC CERTIFICATES > POLYMARKET PREDICTION MARKET SUFFERS $2.7M THEFT VIA COMPROMISED DEBUGBEAR SCRIPT > FBI ATTRIBUTES $6.43 BILLION BINANCE CRYPTO HEIST TO NORTH KOREA'S TRADERTRAITOR GROUP > ADVANCED NETAMLOADER MALWARE EXPLOITS CUSTOM WINDOWS 10 BUILDS IN ASIAN GOVERNMENT NETWORKS > GOOGLE'S PAC-MAN DOODLE AUTOPLAY SOUND INCIDENT > AI-DRIVEN DEVELOPMENT COSTS IN JAVASCRIPT FRAMEWORKS > DATA CENTERS AND AI EMERGE AS KEY MIDTERM ELECTION ISSUES IN BROOKLYN