CVSS 100 LXD MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

A critical flaw in Canonicals LXD and MicroCloud let an attacker log in as a trusted client without holding that clients private key To do it the attacker had to reach their HTTPS API over the network and have the trusted clients public certificate Once in the attacker would act as that client with access to the cluster and its virtual machines If the impersonated account is