Skip to content
fr Sign in
5.0 Medium

CVE-2026-28385 In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import…

Description

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

Affected products and versions

Product Affected versions Fixed in
LXD 6.0 6.0 → < 6.10 6.10

References

Timeline

  1. Published
  2. Last modified

Other CVEs of LXD

The 47 CVEs of LXD →
CVE-2026-112816 Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,… 10.0 Critical CVE-2026-87798 Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up… 5.8 Medium CVE-2026-87799 Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,… 9.9 Critical CVE-2026-97335 Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later… 7.7 High
Track this CVE