2.1
Low
CVE-2026-3351 Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an…
Description
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LXD | 6.6 | No fix stated |
References
- github.com github.com
- lxd/certificates: Return only allowed certificates in non-recursive list github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of LXD
The 47 CVEs of LXD →
CVE-2026-112816
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,…
10.0
Critical
CVE-2026-87798
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up…
5.8
Medium
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,…
9.9
Critical
CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later…
7.7
High