What Happened
A critical LXD and MicroCloud vulnerability carries a CVSS score of 10.0. It lets an attacker log in as a trusted client without holding that client's private key. The attacker only needs to reach the HTTPS API over the network and have the trusted client's public certificate. Once in, they act as that client, with access to the cluster and its virtual machines.
This is an authentication bypass, not a remote code execution. It still matters because the attacker gains the same trust as a legitimate client. If that client has broad privileges in the cluster, the attacker inherits them.
For an MSP, this kind of flaw is dangerous because it gives an attacker a foothold in the same infrastructure that hosts multiple clients. If the impersonated client is an admin, the attacker can reconfigure the cluster, access VM consoles, or exfiltrate data from any workload on that cluster.
The Hacker News reported the flaw on November 1, 2026. No CVE identifier or affected versions were included in the report.
Timeline
- 2026-11-01The Hacker News published a report on the critical LXD and MicroCloud vulnerability.
Who Is Affected
Any environment running Canonical's LXD or MicroCloud where an attacker can reach the HTTPS API over the network. The attacker also needs the public certificate of a trusted client. That means the risk is highest when the API is exposed beyond a small administrative network, or when client certificates are stored or transmitted carelessly.
For MSPs, this affects you if you use LXD or MicroCloud to run client workloads, or if you manage those systems for clients. The same applies to clients who run them internally and rely on you for patching and hardening.
The report does not list specific versions, so assume any deployment of LXD or MicroCloud is potentially exposed until Canonical provides more detail. That is a conservative stance, but it is the right one for a flaw rated 10.0.
What the LXD and MicroCloud Vulnerability Means for MSPs
This is a critical severity issue because it targets the trust model of the management API. LXD and MicroCloud are often used for container and VM orchestration. An attacker who impersonates a trusted client can potentially create, modify, or delete virtual machines, access data inside them, or change cluster configuration.
The saving grace is that exploitation is not remote-only. The attacker must be able to reach the HTTPS API and must have a copy of a trusted client's public certificate. That means network segmentation and certificate handling are your first line of defense.
MSPs should also think about how certificates are provisioned for automated tools and CI/CD pipelines. A public certificate that sits in a script or a configuration file is not a secret, but it becomes dangerous when combined with this flaw.
Treat this as a reminder to review how you store and distribute certificates for your management tools. In general, keep management APIs on isolated networks and rotate certificates on a schedule.
Technical Details
The Hacker News describes the flaw as critical with a CVSS score of 10.0. The attack lets an attacker log in as a trusted client without holding that client's private key. The attacker must be able to reach the HTTPS API over the network and must have the trusted client's public certificate. Once authenticated, the attacker acts as that client and has access to the cluster and its virtual machines.
The report does not include a CVE identifier or specific affected versions.
What to Do This Week
- Restrict network access to the LXD and MicroCloud HTTPS API to only trusted hosts and networks. As a standing practice, never expose management APIs to the internet or to untrusted networks.
- Review your list of trusted clients and certificates. Remove any that are no longer in use, and make sure you know where each public certificate is stored.
- Monitor authentication logs for the HTTPS API for unexpected logins from trusted client identities, especially outside normal hours.
- Check whether Canonical has released a fix or workaround for this vulnerability, and apply it as soon as it is available in your environment.
- Rotate trusted client certificates if you have any reason to believe a public certificate has been exposed. As a general rule, rotate certificates periodically.
What to Tell Clients
A critical vulnerability has been reported in LXD and MicroCloud. An attacker who can reach the HTTPS API and has a trusted client's public certificate can impersonate that client and gain access to the cluster and its virtual machines. We are reviewing our use of these tools and will apply any available patches or mitigations.
If you run LXD or MicroCloud internally, we recommend checking whether the management API is exposed to a wider network than necessary. We can help you review access controls and certificate handling.
We will keep you informed as more details become available.
Frequently Asked Questions
What Is the LXD and MicroCloud Vulnerability?
It is a critical authentication bypass in Canonical's LXD and MicroCloud, scored 10.0 on the CVSS scale. An attacker who can reach the HTTPS API and has a trusted client's public certificate can log in as that client without the private key. This gives them access to the cluster and its virtual machines.
How Does the LXD MicroCloud Attack Work?
The attacker sends requests to the HTTPS API and presents the public certificate of a trusted client. The flaw lets the API accept that certificate as sufficient proof of identity, so the attacker is authenticated as that client. They then have the same access to the cluster as the impersonated client.
Is the LXD and MicroCloud Vulnerability Being Exploited?
The Hacker News report does not mention any active exploitation. It describes the flaw and its severity. Without a CVE or patch details, it is too early to say if attackers have used it.
How Do I Know If I Am Affected by the LXD MicroCloud Flaw?
You are affected if you run Canonical's LXD or MicroCloud and the HTTPS API is reachable by an attacker who can obtain a trusted client's public certificate. The report does not list specific versions, so assume all deployments are potentially exposed until Canonical provides more detail.
What Should I Do About the LXD and MicroCloud Vulnerability?
Restrict network access to the HTTPS API, review your trusted client list, and monitor authentication logs. Check for a fix from Canonical and apply it when available. Rotate trusted client certificates as a precaution.