5.0
Medium
CVE-2026-28385 In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import…
Description
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LXD 6.0 | 6.0 → < 6.10 | 6.10 |
Other CVEs of LXD
The 47 CVEs of LXD →
CVE-2026-112816
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,…
10.0
Critical
CVE-2026-87798
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up…
5.8
Medium
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,…
9.9
Critical
CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later…
7.7
High