9.1
Critique
CVE-2026-34179 In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate…
Description
In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.
Produits et versions touchés
Autres CVE de LXD
Les 47 CVE de LXD →
CVE-2026-112816
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,…
10.0
Critique
CVE-2026-87798
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up…
5.8
Moyenne
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,…
9.9
Critique
CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later…
7.7
Élevée