CVE-2026-28385: Server-Side Request Forgery in Canonical LXD Image Import

Vulnerability ID: CVE-2026-28385
CVSS Score: 5.0
Published: 2026-11-06

CVE-2026-28385 (GHSA-3gq2-x4qg-p4g6) is a Server-Side Request Forgery (SSRF) vulnerability in Canonical LXD versions 4.12 through 6.9. An authenticated user possessing the can_create_images entitlement can force the LXD daemon to execute arbitrary outbound HTTP and HTTPS requests via the /1.0/images API endpoint. Due to the absence of egress destination validation, an attacker can probe host loopback services, RFC 1918 private network segments, and cloud Instance Metadata Services (IMDS) from the network position of the privileged LXD daemon.

TL;DR

Authenticated LXD users with image creation privileges can abuse the URL image import functionality to perform error-based port scanning and interact with internal HTTP services across loopback, private networks, and cloud metadata endpoints.

Technical Details

• Vulnerability Class: CWE-918: Server-Side Request Forgery (SSRF)
• CVSS v3.1 Score: 5.0 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
• Attack Vector: Network via REST API (POST /1.0/images)
• Authentication Required: Yes (User with can_create_images entitlement)
• EPSS Score: 0.28% (20.30th Percentile)
• Affected Versions: Canonical LXD 4.12 through 6.9
• Patched Version: Canonical LXD 6.10
• CISA KEV Status: Not Listed

Affected Systems

• Canonical LXD (versions 4.12 through 6.9)
• LXD: >= 4.12, <= 6.9 (Fixed in: 6.10)

Code Analysis

Commit: 5976c92

doc: update guide to hardening security for LXD (#18462)

Commit: c4a919f

Image registries switchover (#17680)

Commit: 4bbdb17

lxd: Add backward-compatible translation of deprecated image source fields

Mitigation Strategies

• Upgrade Canonical LXD to version 6.10 or later to enforce centralized Image Registries and disable arbitrary URL image imports.
• Route all LXD daemon outbound HTTP and HTTPS connections through a hardened egress proxy that blocks loopback (127.0.0.0/8, ::1), RFC 1918 private subnets, and link-local cloud metadata (169.254.169.254) addresses.
• Audit RBAC policies and revoke the can_create_images entitlement from untrusted users or multi-tenant roles.
• Enable project-level registry restrictions (restricted.registries=builtin) on multi-tenant LXD projects.
• Restrict network exposure of the LXD REST API by binding core.https_address to a dedicated management interface rather than all interfaces.

Remediation Steps:

1. Upgrade the LXD snap or package to version 6.10 or newer: snap refresh lxd --channel=latest/stable
2. Configure an outbound filtering proxy in LXD: lxc config set core.proxy_http "http://:" and lxc config set core.proxy_https "http://:"
3. Restrict untrusted projects to approved image registries: lxc project set restricted.registries=builtin
4. Verify the API listening address is restricted to a management network: lxc config get core.https_address

References

• CVE-2026-28385 Official CVE Record
• NVD Vulnerability Detail: CVE-2026-28385
• GitHub Security Advisory: GHSA-3gq2-x4qg-p4g6
• GitHub Pull Request #18462: Update Guide to Hardening Security for LXD
• GitHub Commit 5976c92: Hardening Guide Update
• GitHub Commit c4a919f: Image Registries Switchover
• GitHub Commit 4bbdb17: Transitional Image Source Allowlist
• Canonical LXD Security Hardening Documentation: Restrict Outbound Requests

Read the full report for CVE-2026-28385 on our website for more details including interactive diagrams and full exploit analysis.