GoPackage

github.com/canonical/lxd

23 known vulnerabilities (9 critical, 6 high, 5 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 23 · 9 critical, 6 high, 5 medium, 3 low

Registry: pkg.go.dev

Advisories 23

GHSA-47W9-6R3F-938GCritical
LXD has restricted project bypass leading to arbitrary command execution
Affected: fixed in 0.0.0-20260630083100-c5184be310b1.
GHSA-7MR3-28H5-M5VXHigh
LXD has project restriction bypass for custom volume copy across projects
Affected: fixed in 0.0.0-20260630083100-c5184be310b1.
GHSA-QX75-2P3R-PWM5High
LXD has project restriction bypass in instance copy across projects
Affected: fixed in 0.0.0-20260630083100-c5184be310b1.
GHSA-PJFF-C2WC-F6JMCritical
LXD has arbitrary file write on client due to trusted image hash
Affected: fixed in 0.0.0-20260630083100-c5184be310b1.
GHSA-FMC8-P6Q7-75CCCritical
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Affected: fixed in 0.0.0-20260630083100-c5184be310b1.
GHSA-VGHH-5RFX-XHQ8Critical
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Affected: fixed in 0.0.0-20260630083100-c5184be310b1.
GHSA-JPF8-86F3-WP38Critical
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Affected: fixed in 0.0.0-20260203144152-d1c8ba15d160.
GHSA-9J25-MM2H-2F76Critical
LXD has arbitrary file write on host via `exec-output` symlink in crafted image
Affected: fixed in 0.0.0-20260626085134-124f90100640.
CVE-2026-28385Medium 5.0
SSRF via image import from URL allows internal network probing by authenticated users
Affected: fixed in 0.0.0-20261005133302-c4a919f3f4e2.
CVE-2026-9639Medium 6.5
Authenticated Denial of Service via Malicious Backup Tarball in LXD
Affected: fixed in 0.0.0-20260622081844-85f897013ccd.
CVE-2026-12411High 8.4
Broken Access Control in Canonical LXD DevLXD API
Affected: from 0.0.0-20250721152936-fe86ceb2c3fa, fixed in 0.0.0-20260626085133-7cb96ac80a6d.
CVE-2026-34179Critical 9.1
Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
Affected: all versions; from 0.0.0-20210305023314-538ac3df036e, through 0.0.0-20260226085519-736f34afb267.
CVE-2026-34178Critical 9.1
Importing a crafted backup leads to project restriction bypass
Affected: from 0.0.0-20210305023314-538ac3df036e, through 0.0.0-20260226085519-736f34afb267; from 0.0.0-20210305023314-538ac3df036e.
CVE-2026-34177Critical 9.1
VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
Affected: from 0.0.0-20210305023314-538ac3df036e, through 0.0.0-20260226085519-736f34afb267; from 0.0.0-20210305023314-538ac3df036e.
CVE-2026-3351Low 2.1
Authorization Bypass in LXD GET /1.0/certificates Endpoint
Affected: all versions; fixed in 0.0.0-20260224152359-d936c90d47cf.

Show all 23 advisoriesShow fewer advisories

CVE-2025-54293High 7.1
Path Traversal in LXD Instance Log File Retrieval
Affected: from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250224180022-ec09b24179f3; from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5.
CVE-2025-54291Medium 6.9
Project existence disclosure in LXD images API
Affected: from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41.
CVE-2025-54290Medium 6.9
Project Existence Disclosure via Error Handling in LXD Image Export
Affected: from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41.
CVE-2025-54289High 7.4
Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
Affected: all versions; from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41.
CVE-2025-54288Medium 5.1
Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
Affected: from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41; from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5.
CVE-2025-54286High 7.5
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
Affected: from 5.0, fixed in 5.0.5; from 5.1, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20220401034332-1e1349e3cbf3, fixed in 0.0.0-20250827065555-0494f5d47e41; all versions.
CVE-2024-6219Low 3.8
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its…
Affected: fixed in 0.0.0-20240403103450-0e7f2b5bf4d2.
CVE-2024-6156Low 3.8
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust…
Affected: fixed in 0.0.0-20240708073652-5a492a3f0036.