Critical LXD and MicroCloud flaw allows impersonation of trusted clients

A critical flaw in Canonical's LXD and MicroCloud allows an attacker to log in as a trusted client without that client's private key. The attacker needs network access to the HTTPS API and the public certificate of a client already trusted by the server. The source states that the flaw is not known to have been used in attacks.