Which versions of Canonical LXD are affected by CVE-2026-28384?

Canonical LXD versions 4.12 through 6.6 contain a critical remote code execution vulnerability enabling unprivileged API users to execute commands with root-level LXD daemon privileges.

How to fix or mitigate CVE-2026-28384?

Within 24 hours, inventory all LXD deployments to identify which systems run versions 4.12 through 6.6 and map API access permissions to determine exposure. Within 7 days, immediately restrict LXD API access to administrative-only accounts, implement multi-factor authentication for API authentication, and establish network segmentation to isolate LXD infrastructure from sensitive business systems using firewalls and separate VLANs. Within 30 days, establish a weekly monitoring schedule of Canonical's security advisories for patch announcements, evaluate alternative container orchestration platforms if patches remain unavailable beyond 60 days, and prepare a phased migration or upgrade plan for all affected production systems.

Canonical LXD CVE-2026-28384

Q: What is the CVSS score of CVE-2026-28384?

CVE-2026-28384 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

CRITICAL

OS Command Injection (CWE-78)

2026-03-12 security@ubuntu.com

Command Injection Canonical Lxd

9.4

CVSS 4.0 · Vendor: ubuntu

Severity by source

Vendor (ubuntu) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable API, low complexity, requires a low-privilege authenticated LXD user (PR:L); command execution as the root daemon escapes the user's authorization context (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ubuntu).

CVSS VectorVendor: ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Sep 11, 2026 - 15:44 vuln.today

Analysis Updated

Sep 11, 2026 - 15:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 11, 2026 - 15:37 vuln.today

cvss_changed

CVSS changed

Sep 11, 2026 - 15:37 NVD

9.4 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 15:16 nvd

N/A

DescriptionCVE.org

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

AnalysisAI

Remote code execution in Canonical LXD 4.12 through 6.6 lets an authenticated but unprivileged LXD API user run arbitrary commands as the root-level LXD daemon by injecting shell content into the compression_algorithm parameter of the image-publish and backup-export endpoints. The daemon passed this attacker-supplied string to a compression command lookup without allowlisting it, turning a routine 'choose your compressor' option into full host takeover. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the root cause is confirmed by Canonical's own security advisory and upstream commits.

Technical ContextAI

LXD is Canonical's container and virtual-machine manager exposed over a REST API (cpe:2.3:a:canonical:lxd). When creating an image (imagesPost) or exporting an instance/volume backup (instanceBackupsPost, storagePoolVolumeTypeCustomBackupsPost), the client may specify a compression_algorithm; LXD's compressFile helper split this string and used field[0] as an executable to look up and run. Because the value was never validated (CWE-78, OS Command Injection), an attacker could smuggle additional command tokens instead of a legitimate compressor name. The fix (commit 043696a…) introduces validate.IsCompressionAlgorithm with a strict allowlist - bzip2, gzip, lzma, pigz, pzstd, squashfs, xz, zstd - rejecting anything else before exec.LookPath is called, and a regression test confirms 'lxc publish --compression=ls' is now rejected.

RemediationAI

Upgrade to a patched snap: 5.0.6-e49d9f4 (5.0/stable), 5.21.4-1374f39 (5.21/stable), or 6.7-1f11451 (6.0/stable) - snap refresh will pull the fixed build for your channel; deployments already on 4.0/stable (4.0.10) are unaffected. If immediate patching is not possible, restrict who holds LXD API/trust credentials and revoke access for lower-trust users, since exploitation requires authenticated API access to the image and backup endpoints; because the vulnerable parameter is a legitimate API option there is no safe feature toggle short of blocking untrusted callers, and tightening trust removes convenience for those users. Reference Canonical's advisory GHSA-4rmf-rcp8-2r9g and the fix commits (043696a13171ace7dd4c2b32d34ce039ab629052, 7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9, b7b411caf5c4971bfe2386c72128f44d7e2aaf4f).