CVE-2026-34179 - Vulnerability Analysis

Overview

Canonical LXD 4.12 through 6.7 contains a broken access control vulnerability caused by lack of validation of the Type field in doCertificateUpdate function during PUT/PATCH requests to /1.0/certificates/{fingerprint}, letting remote authenticated attackers escalate privileges to cluster admin, exploit requires authentication as restricted TLS certificate users.

Severity & Score

Impact

Remote authenticated attackers can escalate privileges to cluster admin, gaining full control over the cluster.

Mitigation

Update to a version later than 6.7 or the latest available version.

References

• https://github.com/canonical/lxd/pull/17936
• https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner