Read the docs
TI-2026-22660 Aliases CVE-2026-28385GHSA-3gq2-x4qg-p4g6

SSRF via image import from URL allows internal network probing by authenticated users

Priority LOW 23CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed lxd (Canonical): 6.10github.com/canonical/lxd (Go): 0.0.0-20261005133302-c4a919f3f4e2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicallxd6.0 to before 6.106.10Patch availableCNA
—github.com/canonical/lxd (Go)before 0.0.0-20261005133302-c4a919f3f4e20.0.0-20261005133302-c4a919f3f4e2Patch availableGHSA-3gq2-x4qg-p4g6
  • lxd VendorCanonical Affected 6.0 to before 6.10 Fixed in 6.10 Patch available CNA
  • github.com/canonical/lxd (Go) Vendor— Affected before 0.0.0-20261005133302-c4a919f3f4e2 Fixed in 0.0.0-20261005133302-c4a919f3f4e2 Patch available GHSA-3gq2-x4qg-p4g6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*4.12 – 6.9VulnerableCanonical
  • cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Versions 4.12 – 6.9 Vulnerable ·Canonical

Remediation

  • Fix · CNA lxd (Canonical) Fixed in 6.10
  • Fix · GHSA-3gq2-x4qg-p4g6 github.com/canonical/lxd (Go) Fixed in 0.0.0-20261005133302-c4a919f3f4e2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28385
  2. 2026-11-06 Alias added: GHSA-3gq2-x4qg-p4g6
  3. 2026-11-06 Fix available: Go/github.com/canonical/[email protected] · GHSA-3gq2-x4qg-p4g6
  4. 2026-11-06 CVSS score added · GHSA-3gq2-x4qg-p4g6
  5. 2026-11-06 Weakness changed · GHSA-3gq2-x4qg-p4g6
  6. 2026-11-06 14 new references · GHSA-3gq2-x4qg-p4g6

References

Exploit 1

Patch 1

Advisory 1

Other 11

  • TI-2026-22659 Authenticated RCE via unsanitized compression_algorithm CVSS 4.0CRITICAL 9.4
  • TI-2026-47475 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVSS 3.1CRITICAL 9.9
  • TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command execution CVSS 3.1CRITICAL 9.9
  • TI-2026-45143 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
  • TI-2026-45142 Project restriction bypass via instance migration config override CVSS 3.1CRITICAL 9.9
  • TI-2026-45140 Root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences