Canonical LXD
CVE-2026-28384
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege LXD API credential
-
ExploitSend image/backup POST with crafted compression_algorithm
-
ExecutionInjected command runs as LXD daemon (root)
-
ImpactAchieve host command execution and full server compromise
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to the LXD REST API with enough trust to call the image-publish or backup-export endpoints (imagesPost, instanceBackupsPost, or storagePoolVolumeTypeCustomBackupsPost) - the CVSS PR:L confirms a valid, unprivileged LXD user is needed, so this is not exploitable by fully anonymous callers. The attacker must supply a malicious compression_algorithm value on one of those requests against LXD 4.12-6.6; deployments on 4.0/stable (4.0.10) or already patched (5.0.6/5.21.4/6.7) are not exploitable. No user interaction and no special non-default configuration is required beyond having API credentials. |
| Impact | This is a genuine high-priority issue for anyone running multi-tenant or shared LXD: the CVSS 4.0 base of 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality/integrity/availability impact and scope change) aligns with an authenticated-but-unprivileged user escalating to root-level command execution on the host, so any operator running an LXD deployment where lower-trust users hold API credentials should treat this as urgent and patch promptly. The signals do diverge on likelihood: EPSS is only 0.12% (30th percentile) and there is no KEV listing or public exploit, which tempers the raw score - exploitation requires valid LXD API access, so this is a privilege-escalation/lateral-movement risk rather than an internet-wide worm target. The gap between the near-critical CVSS and the low EPSS reflects the PR:L prerequisite and absence of published exploit code, not a defect in the finding itself. |
| Exploit ScenarioDerived | An attacker holding a low-privilege LXD API certificate issues a POST to publish an image or export a backup, setting compression_algorithm to a crafted value that appends shell commands instead of a real compressor name; LXD executes it as the daemon (root), granting host command execution and pivot to full server compromise. No public exploit is identified at time of analysis, but the network attack vector and low complexity (AC:L) make weaponization straightforward once API access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 11, 2026
Remote code execution in Canonical LXD 4.12 through 6.6 lets an authenticated but unprivileged LXD API user run arbitrary commands as the root-level LXD daemon by injecting shell content into the compression_algorithm parameter of the image-publish and backup-export endpoints. The daemon passed this attacker-supplied string to a compression command lookup without allowlisting it, turning a routine 'choose your compressor' option into full host takeover. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the root cause is confirmed by Canonical's own security advisory and upstream commits.
Earlier versions of this analysis (1)
unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 versions up to 6.6 is affected by os command injection.
RemediationAI
Upgrade to a patched snap: 5.0.6-e49d9f4 (5.0/stable), 5.21.4-1374f39 (5.21/stable), or 6.7-1f11451 (6.0/stable) - snap refresh will pull the fixed build for your channel; deployments already on 4.0/stable (4.0.10) are unaffected. If immediate patching is not possible, restrict who holds LXD API/trust credentials and revoke access for lower-trust users, since exploitation requires authenticated API access to the image and backup endpoints; because the vulnerable parameter is a legitimate API option there is no safe feature toggle short of blocking untrusted callers, and tightening trust removes convenience for those users. Reference Canonical's advisory GHSA-4rmf-rcp8-2r9g and the fix commits (043696a13171ace7dd4c2b32d34ce039ab629052, 7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9, b7b411caf5c4971bfe2386c72128f44d7e2aaf4f).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LXD is Canonical's container and virtual-machine manager exposed over a REST API (cpe:2.3:a:canonical:lxd). When creating an image (imagesPost) or exporting an instance/volume backup (instanceBackupsPost, storagePoolVolumeTypeCustomBackupsPost), the client may specify a compression_algorithm; LXD's compressFile helper split this string and used field[0] as an executable to look up and run. Because the value was never validated (CWE-78, OS Command Injection), an attacker could smuggle additional command tokens instead of a legitimate compressor name. The fix (commit 043696a…) introduces validate.IsCompressionAlgorithm with a strict allowlist - bzip2, gzip, lzma, pigz, pzstd, squashfs, xz, zstd - rejecting anything else before exec.LookPath is called, and a regression test confirms 'lxc publish --compression=ls' is now rejected.
Know when Lxd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable API, low complexity, requires a low-privilege authenticated LXD user (PR:L); command execution as the root daemon escapes the user's authorization context (S:C) with full C/I/A impact.
Primary rating from Vendor (ubuntu).
CVSS VectorVendor: ubuntu
Lifecycle Timeline
3DescriptionCVE.org
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
Executive ViewAI
Canonical LXD versions 4.12 through 6.6 contain a critical remote code execution vulnerability enabling unprivileged API users to execute commands with root-level LXD daemon privileges. Organizations operating affected versions with non-administrative API access face complete compromise of container infrastructure and underlying host systems. Without a vendor-released patch, immediate implementation of strict access controls and network isolation is mandatory.
No vendor-released patch identified at time of analysis. Implement the following interim controls: restrict LXD API access exclusively to privileged administrative accounts; isolate LXD infrastructure via network segmentation to prevent lateral movement; enable detailed logging and alerting on all API calls and daemon commands; deploy endpoint detection and response (EDR) tooling to detect anomalous root process execution; disable remote API access on systems where local-only management is operationally feasible; and assign personnel to monitor Canonical's security channels weekly for patch availability notices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Cross-site request forgery in the LXD-UI component of Canonical LXD 5.0 before 5.0.5, 5.1 before 5.21.4, and 6.0 before
Privilege escalation in Canonical LXD's operations API (LXD before 6.5 and LXD 5.21 before 5.21.4) allows an authenticat
Authenticated remote attackers with access to the Canonical LXD instance log retrieval or deletion endpoints can read ar
Server-side template injection in Canonical LXD's instance snapshot naming feature lets an authenticated user who can mo
Unauthenticated project enumeration in Canonical LXD 5.21.x before 5.21.4 and 6.x before 6.5 lets remote attackers deter
Unauthenticated remote attackers can confirm the existence of LXD projects on Canonical LXD by comparing HTTP status cod
Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup arc
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Improper certificate validation in the HTTPS API listener of Canonical LXD lets an unauthenticated remote attacker prese
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify wheth
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Exploit-DB