CVE-2026-34179

published 2026-04-09

CVE-2026-34179: In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH…

critical 9.1 CVSS 3.1

AV N AC L PR H UI N S C C H I H A H

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
canonical	lxd	4.12 – 5.0.6	—
canonical	lxd	>= 4.12.0 < 5.0.7	5.0.7
canonical	lxd	>= 5.1.0 < 5.21.5	5.21.5
canonical	lxd	5.21.0 – 5.21.4	—
canonical	lxd	6.0 – 6.7	—
canonical	lxd	>= 6.0.0 < 6.8.0	6.8.0
github.com	canonical_lxd	0.0.0-20210305023314-538ac3df036e – 0.0.0-20260226085519-736f34afb267	—

CWE-915