# github.com/canonical/lxd (Go) vulnerabilities 23 known vulnerabilities (9 critical, 6 high, 5 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/github.com/canonical/lxd ## Advisories (23) ### [GHSA-47W9-6R3F-938G](https://cve.now/GHSA-47W9-6R3F-938G): LXD has restricted project bypass leading to arbitrary command execution - Severity: Critical - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260630083100-c5184be310b1. ### [GHSA-7MR3-28H5-M5VX](https://cve.now/GHSA-7MR3-28H5-M5VX): LXD has project restriction bypass for custom volume copy across projects - Severity: High - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260630083100-c5184be310b1. ### [GHSA-QX75-2P3R-PWM5](https://cve.now/GHSA-QX75-2P3R-PWM5): LXD has project restriction bypass in instance copy across projects - Severity: High - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260630083100-c5184be310b1. ### [GHSA-PJFF-C2WC-F6JM](https://cve.now/GHSA-PJFF-C2WC-F6JM): LXD has arbitrary file write on client due to trusted image hash - Severity: Critical - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260630083100-c5184be310b1. ### [GHSA-FMC8-P6Q7-75CC](https://cve.now/GHSA-FMC8-P6Q7-75CC): LXD has argument injection in backup compression algorithm leading to AFW and ACE - Severity: Critical - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260630083100-c5184be310b1. ### [GHSA-VGHH-5RFX-XHQ8](https://cve.now/GHSA-VGHH-5RFX-XHQ8): LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image - Severity: Critical - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260630083100-c5184be310b1. ### [GHSA-JPF8-86F3-WP38](https://cve.now/GHSA-JPF8-86F3-WP38): LXD has arbitrary file read+write on host via templates/ symlink in malicious image - Severity: Critical - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260203144152-d1c8ba15d160. ### [GHSA-9J25-MM2H-2F76](https://cve.now/GHSA-9J25-MM2H-2F76): LXD has arbitrary file write on host via \`exec-output\` symlink in crafted image - Severity: Critical - Published: Nov 6, 2026 - Affected: fixed in 0.0.0-20260626085134-124f90100640. ### [CVE-2026-28385](https://cve.now/CVE-2026-28385): SSRF via image import from URL allows internal network probing by authenticated users - Severity: Medium 5.0 - Published: Jun 26, 2026 - Affected: fixed in 0.0.0-20261005133302-c4a919f3f4e2. ### [CVE-2026-9639](https://cve.now/CVE-2026-9639): Authenticated Denial of Service via Malicious Backup Tarball in LXD - Severity: Medium 6.5 - Published: Jun 26, 2026 - Affected: fixed in 0.0.0-20260622081844-85f897013ccd. ### [CVE-2026-12411](https://cve.now/CVE-2026-12411): Broken Access Control in Canonical LXD DevLXD API - Severity: High 8.4 - Published: Jun 26, 2026 - Affected: from 0.0.0-20250721152936-fe86ceb2c3fa, fixed in 0.0.0-20260626085133-7cb96ac80a6d. ### [CVE-2026-34179](https://cve.now/CVE-2026-34179): Update of type field in restricted TLS certificate allows privilege escalation to cluster admin - Severity: Critical 9.1 - Published: Apr 9, 2026 - Affected: all versions; from 0.0.0-20210305023314-538ac3df036e, through 0.0.0-20260226085519-736f34afb267. ### [CVE-2026-34178](https://cve.now/CVE-2026-34178): Importing a crafted backup leads to project restriction bypass - Severity: Critical 9.1 - Published: Apr 9, 2026 - Affected: from 0.0.0-20210305023314-538ac3df036e, through 0.0.0-20260226085519-736f34afb267; from 0.0.0-20210305023314-538ac3df036e. ### [CVE-2026-34177](https://cve.now/CVE-2026-34177): VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf - Severity: Critical 9.1 - Published: Apr 9, 2026 - Affected: from 0.0.0-20210305023314-538ac3df036e, through 0.0.0-20260226085519-736f34afb267; from 0.0.0-20210305023314-538ac3df036e. ### [CVE-2026-3351](https://cve.now/CVE-2026-3351): Authorization Bypass in LXD GET /1.0/certificates Endpoint - Severity: Low 2.1 - Published: Mar 3, 2026 - Affected: all versions; fixed in 0.0.0-20260224152359-d936c90d47cf. ### [CVE-2025-54293](https://cve.now/CVE-2025-54293): Path Traversal in LXD Instance Log File Retrieval - Severity: High 7.1 - Published: Oct 2, 2025 - Affected: from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250224180022-ec09b24179f3; from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5. ### [CVE-2025-54291](https://cve.now/CVE-2025-54291): Project existence disclosure in LXD images API - Severity: Medium 6.9 - Published: Oct 2, 2025 - Affected: from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41. ### [CVE-2025-54290](https://cve.now/CVE-2025-54290): Project Existence Disclosure via Error Handling in LXD Image Export - Severity: Medium 6.9 - Published: Oct 2, 2025 - Affected: from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41. ### [CVE-2025-54289](https://cve.now/CVE-2025-54289): Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API - Severity: High 7.4 - Published: Oct 2, 2025 - Affected: all versions; from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41. ### [CVE-2025-54288](https://cve.now/CVE-2025-54288): Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server - Severity: Medium 5.1 - Published: Oct 2, 2025 - Affected: from 0.0.0-20200331193331-03aab09f5b5c, fixed in 0.0.0-20250827065555-0494f5d47e41; from 4.0, fixed in 5.21.4; from 6.0, fixed in 6.5. ### [CVE-2025-54286](https://cve.now/CVE-2025-54286): CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI - Severity: High 7.5 - Published: Oct 2, 2025 - Affected: from 5.0, fixed in 5.0.5; from 5.1, fixed in 5.21.4; from 6.0, fixed in 6.5; from 0.0.0-20220401034332-1e1349e3cbf3, fixed in 0.0.0-20250827065555-0494f5d47e41; all versions. ### [CVE-2024-6219](https://cve.now/CVE-2024-6219): Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its… - Severity: Low 3.8 - Published: Dec 5, 2024 - Affected: fixed in 0.0.0-20240403103450-0e7f2b5bf4d2. ### [CVE-2024-6156](https://cve.now/CVE-2024-6156): Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust… - Severity: Low 3.8 - Published: Dec 5, 2024 - Affected: fixed in 0.0.0-20240708073652-5a492a3f0036. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/canonical/lxd Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.