CVSS 10.0 LXD and MicroCloud TLS Authentication Bypass: Detection and Remediation Guide

---
title: LXD API TLS Handshake from Untrusted Source
id: 7c3f1a82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects TLS connections to the LXD API port from sources that are not expected LXD clients. May indicate reconnaissance or exploitation of the certificate verification bypass.
references:
  - https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 8443
    Initiated: 'true'
  filter_localhost:
    SourceIp:
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter_localhost
falsepositives:
  - Legitimate LXD client connections from admin workstations
  - Cluster member traffic in MicroCloud deployments
level: medium
---
title: LXD Client Certificate File Access by Non-LXD Process
id: 4d8b2c91-5f3a-4e78-bd21-9c0e7f2a4b5c
status: experimental
description: Detects access to LXD client certificate files by processes other than the LXD client (lxc) or legitimate configuration management tools. Attackers may steal public certificates to facilitate impersonation.
references:
  - https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - '/.config/lxc/client.crt'
      - '/.config/lxc/client.key'
      - '/snap/lxd/common/lxd/server.crt'
  filter_legit:
    Image|endswith:
      - '/lxc'
      - '/lxd'
      - '/ansible'
      - '/puppet'
      - '/chef'
  condition: selection and not filter_legit
falsepositives:
  - Backup software accessing configuration directories
  - Security scanners performing file integrity monitoring
level: high
---
title: LXD Privileged Container Creation via API
id: 2e6a9d14-8c5b-4f39-ae47-1b3d5f7c9e2a
status: experimental
description: Detects the creation of privileged LXD containers or the mounting of host filesystems into containers, which is a common post-exploitation behavior after API compromise.
references:
  - https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/lxc'
    CommandLine|contains:
      - 'security.privileged=true'
      - 'source=/ path=/host'
      - 'config device add'
      - 'launch'
  condition: selection
falsepositives:
  - Legitimate administrative container management
  - DevOps pipelines that intentionally create privileged build containers
level: high

// Hunt 1: LXD API connections from external or unexpected sources
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 8443
| where DeviceAction != "Deny"
| extend SourceIP = SourceIP, DestinationIP = DestinationIP
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceName
| order by ConnectionCount desc

// Hunt 2: Access to LXD client certificate files
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("client.crt", "client.key", "server.crt")
| where SyslogMessage has_any ("lxc", "lxd", "config")
| extend Process = extract(@"(?:process|proc)[=: ]+(\S+)", 1, SyslogMessage)
| extend FilePath = extract(@"(/\S*(?:client|server)\.(?:crt|key))", 1, SyslogMessage)
| where isnotempty(FilePath)
| summarize AccessCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, Process, FilePath
| order by AccessCount desc

// Hunt 3: LXD container management commands indicating post-exploitation
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where Process has "lxc"
| where CommandLine has_any ("launch", "exec", "config device add", "security.privileged")
| extend Host = Computer, User = Account
| summarize ExecutionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Host, User, CommandLine
| order by ExecutionCount desc

// Hunt 4: Network connections to LXD API from non-cluster members (requires known cluster IP list)
let LXDClusterIPs = dynamic(["10.0.0.0/8", "172.16.0.0/12"]); // Adjust to your environment
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 8443
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")) and not(ipv4_is_in_range(RemoteIP, "172.16.0.0/12")) // Example external detection
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, InitiatingProcessFileName
| order by ConnectionCount desc

-- Hunt for suspicious LXD API connections and certificate access
-- Artifact: Linux.LXD.CompromiseHunt

-- Section 1: LXD API connections from non-localhost
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'lxc.*(launch|exec|config.*device|security\.privileged)'
   OR Exe =~ '/snap/lxd/.*/bin/lxd'

-- Section 2: Network connections to LXD API port
SELECT Pid, Name, CommandLine, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort == 8443 OR RemotePort == 8443
  AND Status == 'ESTABLISHED'

-- Section 3: File access to LXD certificates (requires auditd or eBPF integration)
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ 'cat|less|more|nano|vi|cp|scp|rsync'
  AND CommandLine =~ 'client\.crt|client\.key|server\.crt'

#!/bin/bash
# LXD and MicroCloud Critical Vulnerability Remediation Script
# CVE: Refer to Canonical security advisory for specific CVE assignment
# Run as root on all LXD hosts and MicroCloud cluster members

set -euo pipefail

LOGFILE="/var/log/lxd_remediation_$(date +%Y%m%d_%H%M%S).log"
exec > >(tee -a "$LOGFILE") 2>&1

echo "=== LXD/MicroCloud Remediation Script ==="
echo "Date: $(date)"
echo "Host: $(hostname)"
echo

# --- Detection: Check if LXD is installed ---
echo "[*] Checking for LXD installation..."
if command -v snap &> /dev/null && snap list lxd &> /dev/null; then
    LXD_SNAP_VERSION=$(snap list lxd | awk 'NR==2 {print $2}')
    echo "[!] LXD snap detected: version $LXD_SNAP_VERSION"
    LXD_TYPE="snap"
elif command -v lxd &> /dev/null; then
    LXD_DEB_VERSION=$(lxd --version 2>/dev/null || echo "unknown")
    echo "[!] LXD deb detected: version $LXD_DEB_VERSION"
    LXD_TYPE="deb"
else
    echo "[+] LXD not found on this system. Checking for MicroCloud..."
    if command -v snap &> /dev/null && snap list microcloud &> /dev/null; then
        echo "[!] MicroCloud snap detected. LXD is embedded."
        LXD_TYPE="microcloud"
    else
        echo "[+] No LXD or MicroCloud installation found. Exiting."
        exit 0
    fi
fi

# --- Pre-Remediation: Backup configuration ---
echo "[*] Backing up LXD configuration..."
BACKUP_DIR="/var/backups/lxd_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
if [[ "$LXD_TYPE" == "snap" ]]; then
    cp -r /var/snap/lxd/common/lxd/* "$BACKUP_DIR/" 2>/dev/null || true
elif [[ "$LXD_TYPE" == "deb" ]]; then
    cp -r /var/lib/lxd/* "$BACKUP_DIR/" 2>/dev/null || true
fi
echo "[+] Backup created at $BACKUP_DIR"

# --- Remediation: Apply updates ---
echo "[*] Applying security updates..."
if [[ "$LXD_TYPE" == "snap" ]]; then
    echo "[*] Refreshing LXD snap..."
    snap refresh lxd --channel=latest/stable
    NEW_VERSION=$(snap list lxd | awk 'NR==2 {print $2}')
    echo "[+] LXD snap updated to version $NEW_VERSION"
elif [[ "$LXD_TYPE" == "deb" ]]; then
    echo "[*] Updating LXD via apt..."
    apt-get update
    apt-get install --only-upgrade lxd lxd-client -y
    echo "[+] LXD deb packages updated"
elif [[ "$LXD_TYPE" == "microcloud" ]]; then
    echo "[*] Refreshing MicroCloud snap (includes LXD)..."
    snap refresh microcloud
    echo "[+] MicroCloud snap updated"
fi

# --- Post-Remediation: Verify and restart ---
echo "[*] Restarting LXD daemon..."
if [[ "$LXD_TYPE" == "snap" ]]; then
    snap restart lxd
elif [[ "$LXD_TYPE" == "deb" ]]; then
    systemctl restart lxd
elif [[ "$LXD_TYPE" == "microcloud" ]]; then
    snap restart microcloud
fi

sleep 5

# --- Verification ---
echo "[*] Verifying LXD service status..."
if [[ "$LXD_TYPE" == "snap" ]]; then
    snap services lxd | grep -q active && echo "[+] LXD snap is active" || echo "[-] LXD snap failed to start"
elif [[ "$LXD_TYPE" == "deb" ]]; then
    systemctl is-active lxd && echo "[+] LXD service is active" || echo "[-] LXD service failed to start"
fi

# --- Certificate Rotation (Precautionary) ---
echo "[*] Rotating LXD server certificate (precautionary)..."
read -p "Rotate server certificate? This will disconnect all existing clients. (yes/no): " -r
if [[ $REPLY =~ ^[Yy][Ee][Ss]$ ]]; then
    if [[ "$LXD_TYPE" == "snap" ]]; then
        rm -f /var/snap/lxd/common/lxd/server.crt /var/snap/lxd/common/lxd/server.key
    elif [[ "$LXD_TYPE" == "deb" ]]; then
        rm -f /var/lib/lxd/server.crt /var/lib/lxd/server.key
    fi
    echo "[*] Restarting LXD to generate new certificate..."
    if [[ "$LXD_TYPE" == "snap" ]]; then
        snap restart lxd
    elif [[ "$LXD_TYPE" == "deb" ]]; then
        systemctl restart lxd
    fi
    echo "[+] Server certificate rotated. All clients must re-trust the new certificate."
else
    echo "[*] Skipping certificate rotation."
fi

# --- Audit Trusted Certificates ---
echo "[*] Auditing trusted client certificates..."
if [[ "$LXD_TYPE" == "snap" ]]; then
    LXC_CMD="/snap/bin/lxc"
elif [[ "$LXD_TYPE" == "deb" ]]; then
    LXC_CMD="/usr/bin/lxc"
else
    LXC_CMD="/snap/bin/lxc"
fi

if [[ -x "$LXC_CMD" ]]; then
    echo "[*] Current trusted certificates:"
    $LXC_CMD config trust list || echo "[-] Failed to list trust. Ensure LXD is running."
    echo
    echo "[!] Review the above certificates. Remove any that are unrecognized or no longer needed:"
    echo "    $LXC_CMD config trust remove <fingerprint>"
else
    echo "[-] lxc client not found. Cannot audit trust store."
fi

# --- Network Hardening Check ---
echo "[*] Checking if LXD API is exposed to network..."
if command -v ss &> /dev/null; then
    LISTENING=$(ss -tlnp | grep :8443 || true)
    if [[ -n "$LISTENING" ]]; then
        echo "[!] LXD API is listening on network:"
        echo "$LISTENING"
        echo "[!] RECOMMENDATION: Restrict access via firewall to authorized management IPs only."
        echo "    Example: iptables -A INPUT -p tcp --dport 8443 -s <MGMT_CIDR> -j ACCEPT"
        echo "             iptables -A INPUT -p tcp --dport 8443 -j DROP"
    else
        echo "[+] LXD API is not listening on TCP/8443 or is socket-activated locally."
    fi
fi

echo
echo "=== Remediation Complete ==="
echo "Log file: $LOGFILE"
echo "Next steps:"
echo "1. Verify patched version: $LXC_CMD version"
echo "2. Review trusted certificates: $LXC_CMD config trust list"
echo "3. Restrict network access to TCP/8443"
echo "4. Monitor for suspicious API activity"