A critical security flaw affecting Canonical’s LXD and MicroCloud has been reported with a maximum-severity CVSS score of 10.0. According to the report, an attacker who can reach the exposed HTTPS API and obtain a trusted client’s public certificate may be able to authenticate as that client without possessing its private key.

For businesses using LXD or MicroCloud to manage virtual machines and clustered infrastructure, the issue raises immediate concerns around unauthorised access, infrastructure isolation and administrative trust between systems.

What happened

The reported vulnerability affects the trust model used by LXD and MicroCloud. The core issue, as described in the source report, is that an attacker could impersonate a trusted client if two conditions are met:

• the attacker can access the product’s HTTPS API over the network
• the attacker has a copy of a trusted client’s public certificate

If successful, the attacker could log in as that trusted client and interact with the cluster using that identity. In practical terms, that may provide access to cluster resources and the virtual machines managed through the environment, depending on the permissions associated with the impersonated client.

The source describes the vulnerability as critical. At the time of writing, businesses should rely on official Canonical guidance for confirmed remediation steps, affected versions and patch availability.

Why it matters for European businesses

This issue is especially relevant for organisations using private cloud, virtualisation or container-based infrastructure to run internal services, development environments, customer platforms or business applications.

Unlike lower-impact software bugs, an authentication bypass affecting trusted machine-to-machine or administrator access can undermine the security assumptions of the entire environment. If an attacker can appear as a previously trusted client, standard identity checks may not detect the intrusion.

For European businesses, the main risks include:

• Infrastructure compromise: attackers may gain access to clusters or virtual machines that support websites, applications, internal systems or customer services
• Operational disruption: compromised infrastructure can lead to outages, configuration changes or loss of service availability
• Data exposure: virtual machines may contain business data, credentials, customer information or application secrets
• Compliance consequences: if personal data or critical systems are affected, organisations may face GDPR, contractual or sector-specific incident handling obligations

The flaw is also a reminder that certificate-based trust should still be protected by network controls, access restrictions and monitoring. Even when strong cryptographic mechanisms are used, implementation flaws can create a path around expected protections.

Who may be affected

The organisations most likely to be affected are those that use LXD or MicroCloud in production or administrative environments, particularly where management APIs are reachable over internal or external networks.

• SMEs running self-hosted virtual infrastructure
• IT teams managing clustered Linux-based environments
• Digital agencies and SaaS providers hosting customer workloads
• E-commerce businesses operating private application infrastructure
• Companies with development, staging or backup systems on LXD-based platforms

Risk may be higher where API exposure is broad, certificate material is widely distributed, or trusted client identities have elevated privileges.

What companies should consider

Organisations using the affected products should review official vendor advisories and verify whether their deployments are exposed. While remediation depends on Canonical’s confirmed guidance, businesses can already take several practical steps:

• Identify exposure: inventory any LXD or MicroCloud instances and determine whether their HTTPS APIs are reachable from untrusted networks
• Restrict network access: limit API access to known management hosts, VPN ranges or administrative networks where possible
• Review trusted clients: audit which client certificates are trusted and remove entries that are no longer required
• Check privileges: confirm whether trusted client identities have broader access than necessary and reduce permissions where feasible
• Monitor for unusual activity: review logs for unexpected client authentication events, configuration changes or access to virtual machines
• Prepare patching: plan to apply vendor-provided fixes quickly once validated for the relevant environment
• Protect certificate handling: although the reported issue involves public certificates, businesses should still review certificate distribution and administrative security practices

For organisations subject to stricter security or resilience obligations, including regulated sectors and critical service providers, this type of vulnerability may also justify a broader review of infrastructure trust relationships and access segmentation.

The key business takeaway is straightforward: if LXD or MicroCloud is part of your infrastructure stack, this is a vulnerability worth urgent review because it may affect the security boundary around your virtual environments.