CVE-2025-54286

High CVSS: 7.5

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

Vendor

Canonical

Product

Lxd

CWE

CWE-352

Yayın Tarihi

2025-10-02 10:15:38

Güncelleme

2025-10-22 15:47:31

Source Identifier

security@ubuntu.com

KEV Date Added

Kategoriler

CWE-352 Lxd HIGH Canonical 2025

Referanslar

https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h

Benzer Kayıtlar

Critical

CVE-2026-4370

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the inter…

Medium

CVE-2026-32694

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret o…

Medium

CVE-2026-32691

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit…

High

CVE-2026-32692

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18…

High

CVE-2026-32693

In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which…

Low

CVE-2026-3351

Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated,…