Canonical LXD CVE-2025-54289

Exploitation requires (1) an authenticated account with at least read permissions on the target LXD server, and (2) another user concurrently opening a terminal or console (exec) session, because the attack hijacks the secret 'fds' values that LXD's operations API (/1.0/operations/{id}/websocket and /1.0/events) exposes for those running operations. The specific weakness is that terminal/console WebSocket authentication secrets are returned in operation metadata readable by read-only principals (CWE-1385). Limiting factors: no code execution occurs unless a victim session exists to hijack (AT:P/UI:P), the attacker must already hold a valid read account (PR:L, not anonymous), success depends on timing against another user's session (AC:H), and it is fixed in LXD 5.21.4 and 6.5 - unaffected deployments are those patched or not using interactive terminal/console sessions.

Signals point consistently to a real-but-moderate, non-urgent priority rather than a mass-exploitation threat. The CVSS 4.0 base score is 7.4 (High), but the vector itself tempers this: AC:H and AT:P (passive attack requirement) plus UI:P mean exploitation depends on timing a victim's action, and PR:L confirms the attacker already needs a valid - if only read-scoped - account on the LXD instance. EPSS is very low (0.04%, 12th percentile), indicating no statistical signal of widespread exploitation attempts, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A public POC does exist (a browser-DevTools JavaScript snippet in the GHSA advisory), which lowers the skill barrier, but POC availability is a distinct signal from active exploitation and should not be conflated with it. The low EPSS is coherent with (not contradicted by) the preconditions: the attacker must have an authenticated read account AND a victim must concurrently open a terminal/console session, which makes this better suited to targeted insider/lateral-movement scenarios than opportunistic internet-wide scanning. Net: a legitimate privilege-escalation issue worth patching on normal cycles, not a drop-everything emergency.

A low-privilege user with only read permissions on an LXD deployment (e.g., via LXD-UI) runs attacker-supplied JavaScript that subscribes to the /1.0/events operations stream, harvests the WebSocket secret values exposed for terminal/console operations, and opens its own WebSocket to a session another user has just started. A working POC exists in the vendor GHSA advisory demonstrating injection of a command (e.g., 'touch /tmp/xxx') into the hijacked data channel. Because AC:H/AT:P/UI:P apply, success requires catching a victim-initiated session, so exploitation is opportunistic on timing rather than reliably on-demand.