Critical Vulnerability in Canonical LXD and MicroCloud Enables Client Impersonation
CVSS 10.0 Flaw Allows Unauthorized Access Without Private Key
Key Takeaways
- Critical CVSS 10.0 vulnerability in Canonical LXD and MicroCloud allows client impersonation without a private key.
- Attackers need network access to the HTTPS API and the target's public certificate to exploit the flaw.
- Successful exploitation grants unauthorized access to clusters and virtual machines.
Related Security News
Microsoft Authenticator Android Flaw Fixed After Permissionless Token Theft
Microsoft has patched a security vulnerability in the Authenticator app for Android that permitted malicious applications with no permissions to pose as trusted Microsoft apps, such as Teams, and collect sign-in tokens for a victim's work account. The flaw, tracked as CVE-2026-80097, was addressed in Authenticator for Android version 6.2606.4246. Users are advised to update the application immediately to mitigate the risk of unauthorized access to work accounts.
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA has added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed active exploitation in the wild. The flaws, including CVE-2026-111357 with a CVSS score of 8.8, allow missing authentication for critical functions. Threat actors are chaining multiple Ivanti Connect Secure flaws to gain unauthenticated root access. Ivanti has released security updates; CISA recommends immediate patching.
