CVE-2026-28385 Details
Description
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in Canonical LXD versions 4.12 through 6.9. This vulnerability allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. The issue arises because the LXD daemon does not properly validate or restrict outbound IP addresses when importing images from URLs. As a result, connections can be made to loopback addresses, private RFC1918 ranges, and cloud metadata endpoints. Exploiting this vulnerability could enable error-based port scanning and unauthorized access to internal HTTP services from the daemon's network position.
Users can update to LXD version 6.10, where this vulnerability has been patched. Additionally, the LXD documentation has been updated to guide users on setting up an HTTP/HTTPS proxy to control which remote image URLs can be used.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/canonical/lxd/pull/18462 | [email protected] | Issue TrackingPatch |
| https://github.com/canonical/lxd/security/advisories/GHSA-3gq2-x4qg-p4g6 | [email protected] | ExploitVendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| canonical lxd | >= 4.12, <= 6.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |