Canonical Lxd vulnerabilities

CVE-2025-54292 [MEDIUM] CWE-22 CVE-2025-54292: Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

CVE-2026-63295 [MEDIUM] CWE-863 CVE-2026-63295: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-leve An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the securi

CVE-2026-33542 [MEDIUM] CVE-2026-33542: Incus is a system container and virtual machine manager Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.

CVE-2016-1582 [MEDIUM] CWE-200 CVE-2016-1582: LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into pri LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.

CVE-2016-1581 [MEDIUM] CWE-284 CVE-2016-1581: LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop bas LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors.

CVE-2026-3351 [MEDIUM] CWE-862 CVE-2026-3351: Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allow Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.

CVE-2024-6156 [LOW] CWE-295 CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's c Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

CVE-2024-6219 [LOW] CWE-295 CVE-2024-6219: Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could b Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.