Canonical Lxd
23 CVEs affecting Canonical Lxd. Latest disclosed: 2026-06-26. Critical: 3, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34179 | Critical | 9.1 | 2026-04-09 | In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH re… |
CVE-2026-34178 | Critical | 9.1 | 2026-04-09 | In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instan… |
CVE-2026-34177 | Critical | 9.1 | 2026-04-09 | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.appa… |
CVE-2025-54286 | High | 8.8 | 2025-10-02 | Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user c… |
CVE-2026-12411 | High | 8.4 | 2026-06-26 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's cust… |
CVE-2025-54289 | High | 8.1 | 2025-10-02 | Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions… |
CVE-2026-9640 | High | 7.2 | 2026-06-26 | A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restrict… |
CVE-2025-54288 | Medium | 6.8 | 2025-10-02 | Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any con… |
CVE-2023-49721 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2023-48733 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2026-9639 | Medium | 6.5 | 2026-06-26 | Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes… |
CVE-2025-54293 | Medium | 6.5 | 2025-10-02 | Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host s… |
CVE-2025-54287 | Medium | 6.5 | 2025-10-02 | Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitr… |
CVE-2016-1582 | Medium | 5.5 | 2016-06-09 | LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary… |
CVE-2016-1581 | Medium | 5.5 | 2016-06-09 | LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data… |
CVE-2025-54291 | Medium | 5.3 | 2025-10-02 | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project exist… |
CVE-2025-54290 | Medium | 5.3 | 2025-10-02 | Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without auth… |
CVE-2026-28385 | Medium | 5.0 | 2026-06-26 | In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users wit… |
CVE-2025-54292 | Medium | 4.6 | 2025-10-02 | Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended res… |
CVE-2026-3351 | Medium | 4.3 | 2026-03-03 | Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certif… |