CVE-2026-34179

CWE-9153 documents3 sources
Severity
9.1CRITICAL
EPSS
0.1%
top 75.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Canonical LXDGithub.com Canonical/lxd
Timeline
PublishedApr 9
Latest updateApr 10

Description

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5canonical/lxd4.12.0 — 5.0.7+2
▶Gogithub.com/canonical/lxd0.0.0-20210305023314-538ac3df036e — 0.0.0-20260226085519-736f34afb267

🔴Vulnerability Details

2
GHSA
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin↗2026-04-10
▶
CVEList
Update of type field in restricted TLS certificate allows privilege escalation to cluster admin↗2026-04-09
▶
CVE-2026-34179 (CRITICAL CVSS 9.1) | In Canonical LXD versions 4.12 thro | cvebase.io