Description
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | lxd | 6.0 – < 6.10 | 6.10 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | lxd | No fix yet | — |
| Debian 12 | lxd | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/canonical/lxd | < 0.0.0-20261005133302-c4a919f3f4e2 | 0.0.0-20261005133302-c4a919f3f4e2 | GHSA-3gq2-x4qg-p4g6 |
References
- SSRF via image import from URL allows internal network probing by authenticated users vdb-entry vendor-advisory
- doc: update guide to hardening security for LXD patch issue-tracking