Server-Side Request Forgery in Canonical LXD Allows Internal Network Interaction

CVE-2026-28385

What is CVE-2026-28385?

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability exists within the image import feature, enabling authenticated users with the proper entitlements to exploit internal network infrastructures via the /images endpoint. The LXD daemon does not effectively validate or restrict outbound IP addresses, allowing inadvertent access to loopback addresses, private IP ranges, and cloud metadata services. This oversight may permit malicious actions such as error-based port scanning and unauthorized interactions with internal HTTP services, presenting significant risks to network integrity.

References