Exposed LXD and Incus management interfaces can let remote attackers impersonate trusted clients and control clusters or managed virtual machines. The certificate-checking process proved ownership of one certificate but trusted other attacker-supplied certificates in the same chain. An attacker could append a public trusted certificate without possessing its private key. Incus rated the issue critical, while no active exploitation was reported.
Why It Matters
The affected management layer can provide access to clusters, virtual machines, trust-store entries, and internal connections. Internet-reachable HTTPS listeners carry the highest immediate exposure. For leaders: a certificate is not proof of identity unless ownership is validated correctly. For defenders: update affected releases and restrict management interfaces to trusted hosts while remediation is underway. Network restrictions reduce exposure but do not repair the validation failure. The larger lesson is that subtle trust mistakes can bypass otherwise strong authentication designs.
What Defenders Should Do
Update LXD and Incus immediately and limit HTTPS management access to trusted systems until patching is complete.