EUVD-2026-39805Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
PR:L reflects the required can_create_images entitlement; S:C and C:L capture cross-boundary reconnaissance of internal services; no integrity or availability impact applies.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
AnalysisAI
Server-Side Request Forgery in Canonical LXD's image import endpoint allows authenticated users holding the can_create_images entitlement to direct the LXD daemon to make arbitrary outbound HTTP connections, including to loopback addresses, RFC1918 private ranges, and cloud instance metadata services such as 169.254.169.254. Affected versions span 4.12 through 6.9. An attacker can leverage error-based responses to enumerate internal TCP ports and fingerprint internal HTTP services from the daemon's privileged network position, enabling lateral reconnaissance in multi-tenant or cloud-hosted environments. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV.
Technical ContextAI
LXD is Canonical's open-source system container and virtual machine manager, primarily used on Ubuntu hosts. Its REST API exposes a /images endpoint that accepts URL-based image imports, causing the lxd daemon process to initiate outbound HTTP(S) connections. CWE-918 (Server-Side Request Forgery) describes this root cause: the application fetches a remote resource using attacker-controlled input without validating or restricting the destination address. Because the daemon process typically runs with elevated host-level privileges and direct access to host network interfaces, it may reach internal management planes, cloud metadata APIs (AWS IMDSv1 at 169.254.169.254, GCP at metadata.google.internal), Kubernetes API servers, or other infrastructure not reachable from unprivileged workloads. The CPE string cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* confirms this applies across the LXD application product line without OS-level qualification. The CVSS scope flag S:C reflects that the vulnerable LXD component can impact resources outside its own security context - specifically the internal services it reaches.
RemediationAI
An upstream patch is available via GitHub pull request #18462 (https://github.com/canonical/lxd/pull/18462); however, a tagged released version incorporating this fix was not independently confirmed at time of analysis - operators should verify the fix version in the official advisory at https://github.com/canonical/lxd/security/advisories/GHSA-3gq2-x4qg-p4g6 before upgrading. As a documented workaround, Canonical recommends deploying a filtering proxy and configuring both core.proxy_http and core.proxy_https LXD server settings to route all outbound HTTP/HTTPS through it; the proxy should block connections to loopback addresses, RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata endpoints (169.254.169.254, fd00:ec2::254, metadata.google.internal). Note that setting up a proxy introduces a dependency on proxy availability and may break legitimate image imports from public registries if misconfigured. A secondary hardening measure from the PR diff is to bind the LXD API to a specific trusted IP and port rather than a port alone (e.g., use 192.0.2.10:8443 instead of :8443) to limit which network interfaces can reach the API at all, reducing the pool of users who can reach the vulnerable endpoint.
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attacker
A arbitrary file access vulnerability (CVSS 6.5) that allows an attacker with instance configuration permissions. Risk
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify wheth
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted proj
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authentica
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today