CVE-2026-28384

published 2026-03-12

CVE-2026-28384: An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD…

Priority P2 60 critical 9.4 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
canonical	lxd	—	—
canonical	lxd	>= 0 < 5.0.2-5+deb12u4	5.0.2-5+deb12u4
canonical	lxd	>= 0 < 5.0.2+git20231211.1364ae4-9+deb13u4	5.0.2+git20231211.1364ae4-9+deb13u4
canonical	lxd	>= 5.0.0 < 5.0.6	5.0.6
canonical	lxd	>= 5.21.0 < 5.21.4	5.21.4
canonical	lxd	>= 6.0 < 6.7	6.7
debian	incus	< incus 6.0.6-1 (forky)	incus 6.0.6-1 (forky)
debian	lxd	< incus 6.0.6-1 (forky)	incus 6.0.6-1 (forky)

Detection & IOCs extracted from sources · hover to see the quote

• → Exploit targets the `compression_algorithm` parameter in API calls to the LXD image and backup endpoints — monitor for unsanitized or shell-metacharacter-containing values in this parameter in LXD API requests ↗
• → Audit LXD API calls to the `/1.0/images` and `/1.0/backups` endpoints for anomalous `compression_algorithm` values, especially those containing shell special characters (e.g., `;`, `|`, `$()`, backticks) ↗
• → Affected LXD versions are 4.12 through 6.6 (snap); flag any LXD daemon process running these versions handling external API requests from unprivileged users ↗

• · Fixed snap versions: 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), 6.7-1f11451 (channel 6.0/stable). Verify snap channel and build hash to confirm patch status. ↗
• · The 4.0/stable snap channel is NOT affected as it ships version 4.0.10 — do not flag this channel as vulnerable. ↗
• · Debian packages are fixed in 6.0.6-1 (forky/sid) and 6.0.4-2+deb13u5 (trixie). Scope is classified as local by the Debian security tracker. ↗

CVSS provenance

nvd v4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 9.4 CRITICAL

vendor_debian 9.4 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78