CVE-2026-28385
Description
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
How to fix
- github.com/canonical/lxd0.0.0-20261005133302-c4a919f3f4e2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canonical lxd | 4.12 ≤ v ≤ 6.9 | — |
| github.com/canonical/lxdGo | v < 0.0.0-20261005133302-c4a919f3f4e2 | 0.0.0-20261005133302-c4a919f3f4e2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.