https://curasec.metacog.co.kr/tags/lxd/Recent content in Lxd on CuraSecHugoen-usSun, 01 Nov 2026 17:05:59 +0000https://curasec.metacog.co.kr/insights/2026-11-01-cvss-10-0-lxd-microcloud-flaw-lets-attackers-impersonate-tru/Sun, 01 Nov 2026 17:05:59 +0000https://curasec.metacog.co.kr/insights/2026-11-01-cvss-10-0-lxd-microcloud-flaw-lets-attackers-impersonate-tru/<ul> <li><strong>Engineer — Plan:</strong> Teams running LXD or MicroCloud clusters should prioritize patching — an authentication bypass at CVSS 10.0 could allow cluster takeover and VM access. No KEV listing or public PoC in the enrichment signals, but the attack surface (network-reachable HTTPS API) warrants patching this sprint rather than waiting for a routine cycle.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>https://curasec.metacog.co.kr/insights/2026-10-31-cve-10-0-cve-2026-112816-canonical-lxd-no-emudhra-required/Sat, 31 Oct 2026 16:03:46 +0000https://curasec.metacog.co.kr/insights/2026-10-31-cve-10-0-cve-2026-112816-canonical-lxd-no-emudhra-required/<ul> <li><strong>Engineer — Learn:</strong> A perfect-score CVSS on a container/VM hypervisor warrants attention, but EPSS is 0.00, no PoC exists, and the source summary is too thin to confirm patch availability or vulnerability class — monitor Canonical&rsquo;s advisory for LXD version details before acting.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> <li><strong>Signals:</strong> CVE-2026-112816 — CISA KEV: not listed, EPSS 0.00, no public PoC found</li> </ul>