Critical LXD and MicroCloud Security Flaw Receives Maximum CVSS Score
canonical has addressed a critical security vulnerability in LXD and MicroCloud that allowed unauthorized authentication to network APIs.
FTMQ Security, written by our newsroom0 views
The Hacker News reported that a critical vulnerability rated CVSS 10.0 was discovered in Canonical LXD and MicroCloud software. The security flaw allows an unauthenticated attacker to log in as a trusted client without possessing the required private key. [1]
According to The Hacker News, an attacker must be able to reach the HTTPS API over the network to carry out the exploit. The attacker also needs access to the public certificate belonging to the trusted client. [1]
Public key cryptography relies on a pair of keys consisting of a public key and a private key. While public keys can be distributed openly without compromising system security, asymmetric systems depend on keeping the private key confidential. [5]
In a separate security issue, shattered.io reported that an Azure Kubernetes configuration flaw received a CVSS score of 10.0 on October 22, 2026. [2]
In short
- A critical flaw in LXD and MicroCloud earned a maximum CVSS 10.0 severity rating.
- Attackers can impersonate trusted clients without holding their private keys.
- Exploitation requires network access to the HTTPS API and the target public certificate.
- An Azure Kubernetes configuration flaw was also rated CVSS 10.0 on October 22, 2026.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private KeyThe Hacker News, 14h ago (the report this story comes from)
- [2]Azure Kubernetes Config Flaw Hits CVSS 10.0, Oct. 22 [2026]shattered.io, 15h ago
Background
- [3]Wikipedia on Wikipedia
- [4]Trusted Computing on Wikipedia
- [5]Public-key cryptography on Wikipedia
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Oracle fixes 1295 vulnerabilities including six maximum severity flawsTop Stories, 8d ago
More in Top Stories
- CISA adds actively exploited Ivanti flaws to known vulnerabilities catalog23h ago
- Syrian Electronic Army Hacker Sentenced to 42 Months in US Court23h ago
- Chainalysis suffers cybersecurity breach exposing customer contact data23h ago
- Binance hit by record six point three billion dollar cryptocurrency theft23h ago
- Proof of concept exploit released for Android SMS vulnerability23h ago
- Chinese hackers use AI framework ARTEX to target over 200 organizations1d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.