CVE-2026-28385: fallo de gravedad media en Canonical lxd
SSRF via image import from URL allows internal network probing by authenticated users
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5epss 0.3%
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Productos afectados
Canonical · lxdCVEs relacionadas — Canonical lxd
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-28384CRITICALAuthenticated RCE via unsanitized compression_algorithmEPSS 0.8%CVE-2026-34178CRITICALImporting a crafted backup leads to project restriction bypassEPSS 0.4%CVE-2026-34177CRITICALVM lowlevel restriction bypass via raw.apparmor and raw.qemu.confEPSS 0.4%CVE-2026-34179CRITICALUpdate of type field in restricted TLS certificate allows privilege escalation to cluster adminEPSS 0.3%CVE-2026-12411HIGHBroken Access Control in Canonical LXD DevLXD APIEPSS 0.2%CVE-2026-3351LOWAuthorization Bypass in LXD GET /1.0/certificates EndpointEPSS 0.2%