CVE-2026-28385 · GHSA-3gq2-x4qg-p4g6

LXD: SSRF via image import from URL allows internal network probing by authenticated users

Risk score: 44/100
CVSS: 5.0 v3.1
Exploit chance (30 days): 0.3%
Published: 26 Jun 2026

Open in the live forecast Today's forecast

What to know

What it is: In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LX…
Affected: github.com/canonical/lxd (go) < 0.0.0-20261005133302-c4a919f3f4e2
Fix: Upgrade github.com/canonical/lxd to 0.0.0-20261005133302-c4a919f3f4e2 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/canonical/lxd: Amber, patch this week. A vulnerability in Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request. This could enable an attacker to access sensitive data or disrupt the system.

The flaws

CVE-2026-28385: LXD: SSRF via image import from URL allows internal network probing by authenticated users (CVSS 5.0 · EPSS 0%)
CVE-2026-12411: Lxd allows Cross-guest volume hijack via DevLXD device patch (CVSS 9.6 · EPSS 0%)

The fix

Fix: Upgrade to version 0.0.0-20260626085133-7cb96ac80a6d or later

Who is exposed: {'product': 'lxd', 'package': 'github.com/canonical/lxd', 'version': '>= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d'}

Where it stands

Public proof of concept

Connects to

Same weakness: Server-side request forgery (CWE-918). 293 other warnings in 30 days

Why it is Yellow

CVSS 5.0 medium
Public exploit or proof of concept referenced
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/canonical/lxd	go	< 0.0.0-20261005133302-c4a919f3f4e2	0.0.0-20261005133302-c4a919f3f4e2

References

Original description

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

Last activity 6 Nov 2026. Patch Forecast updates every hour.