LXD MicroCloud CVSS 10.0 flaw enables client impersonation

A critical vulnerability in Canonical's LXD and MicroCloud allows attackers to impersonate trusted clients without possessing their private key. Attackers need network access to the HTTPS API and the target client's public certificate. Successful exploitation grants full access to the cluster and virtual machines with the compromised client's privileges. A patch is recommended for all affected deployments.