Canonical Lxd vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Canonical Lxd: 37 record(s), with affected versions and fixes.cpe:2.3:a:canonical:lxd
CVE-2026-34177
Critical · 9.1
CWE-184 Apr 9, 2026
VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root.
CVE-2026-28384
Critical · 9.9
CWE-78 Mar 12, 2026
Authenticated RCE via unsanitized compression_algorithm
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
CVE-2026-3351
Medium · 4.3
CWE-862 Mar 3, 2026
Authorization Bypass in LXD GET /1.0/certificates Endpoint
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
CVE-2025-54293
Medium · 6.5
CWE-22 Oct 2, 2025
Path Traversal in LXD Instance Log File Retrieval
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
CVE-2025-54292
Medium · 4.6
CWE-22 Oct 2, 2025
Client-Side Path Traversal in LXD-UI
Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.
CVE-2025-54291
Medium · 5.3
CWE-209 Oct 2, 2025
Project existence disclosure in LXD images API
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
CVE-2025-54290
Medium · 5.3
CWE-200 Oct 2, 2025
Project Existence Disclosure via Error Handling in LXD Image Export
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
CVE-2025-54289
High · 8.1
CWE-1385 Oct 2, 2025
Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
CVE-2025-54288
Medium · 6.8
CWE-290 Oct 2, 2025
Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
CVE-2025-54287
Medium · 6.5
CWE-1336 Oct 2, 2025
Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration
permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
CVE-2025-54286
High · 8.8
CWE-352 Oct 2, 2025
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.
CVE-2023-48733
Medium · 6.7
CWE-1188 Feb 14, 2024
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an...
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.