Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-28385
PUBLISHED
More InfoOfficial Page
Assigner-canonical
Assigner Org ID-cc1ad9ee-3454-478d-9317-d3e869d708bc
View Known Exploited Vulnerability (KEV) details
Published At-26 Jun, 2026 | 16:23
Updated At-26 Jun, 2026 | 17:13
Rejected At-
▼CVE Numbering Authority (CNA)
SSRF via image import from URL allows internal network probing by authenticated users

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

Affected Products
Vendor
Canonical Ltd.Canonical
Product
lxd
Collection URL
https://github.com/canonical
Package Name
lxd
Repo
https://github.com/canonical/lxd
Program Files
  • permissions.go
Platforms
  • Linux
Default Status
unaffected
Versions
Affected
  • From 6.0 before 6.10 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-918CWE-918: Server-Side Request Forgery (SSRF)
Type: CWE
CWE ID: CWE-918
Description: CWE-918: Server-Side Request Forgery (SSRF)
Metrics
VersionBase scoreBase severityVector
3.15.0MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Version: 3.1
Base score: 5.0
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-664CAPEC-664: Server Side Request Forgery
CAPEC ID: CAPEC-664
Description: CAPEC-664: Server Side Request Forgery
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Babajide Emmanuel Fakile
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/canonical/lxd/security/advisories/GHSA-3gq2-x4qg-p4g6
vdb-entry
vendor-advisory
https://github.com/canonical/lxd/pull/18462
patch
issue-tracking
Hyperlink: https://github.com/canonical/lxd/security/advisories/GHSA-3gq2-x4qg-p4g6
Resource:
vdb-entry
vendor-advisory
Hyperlink: https://github.com/canonical/lxd/pull/18462
Resource:
patch
issue-tracking
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found