CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

A critical vulnerability (CVSS 10.0) was discovered in Canonical's LXD and MicroCloud products that allows attackers to impersonate trusted clients without possessing their private key. The attack requires network access to the HTTPS API and knowledge of the trusted client's public certificate. Once authenticated as the impersonated client, the attacker gains full access to the cluster and its virtual machines. The severity of the impact depends on the privilege level of the impersonated account, potentially allowing complete cluster compromise. This flaw represents a fundamental authentication bypass in the certificate-based trust system used by LXD and MicroCloud.