A newly discovered vulnerability in Incus and Canonical LXD allows unauthenticated attackers to impersonate trusted identities, bypass authorization, and compromise virtualization environments This article explores authorization compromise virtualization. . Crafted certificate chains can expose internal cluster services, while Canonical confirms that the LXD vulnerability enables full access to clusters and managed virtual machines.
Authentication and certificate validation checks ensure every presented certificate matches the trust store, preventing unauthorized identities from accessing resources.
Presenting the target server’s certificate grants database gateway access, while presenting another cluster member’s certificate enables internal cluster access and circumvents authorization entirely. Attackers can renew or delete trust store entries through self-service operations, and the agent connection authentication between hosts and virtual machines is also compromised. Attacker-controlled certificates can influence scripted authorization decisions, including connections authenticated via tokens or OpenID Connect instead of mutual TLS.
The notice specifies affected versions including 4.0.14, 5.0.10, 5.21.8, and 6.9, with fixes in 4.0.15, 5.0.11, 5.21.9, and 6.10.1, respectively. It explicitly states that no configuration-based workaround exists, making network restrictions a temporary exposure-reduction measure rather than a substitute for installing the corrected software across all affected deployments. Explore for your team
