Improper Authorization in Canonical LXD on Linux Affects User Security

CVE-2026-3351

What is CVE-2026-3351?

An improper authorization vulnerability exists within the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux. This flaw allows an authenticated but restricted user to enumerate all certificate fingerprints that the LXD server trusts. Such unauthorized access may lead to exposure of sensitive information and enhance the risk of further attacks. It is crucial for users of Canonical LXD to assess their security posture and implement any necessary updates or mitigations to protect their systems.

References