Executive brief
Canonical LXD, a tool used to manage system containers and virtual machines, contains a security flaw in how it imports images from web addresses. An authorized user can trick the system into connecting to internal network services, such as private databases or cloud management interfaces, that should normally be inaccessible. While the attacker cannot directly steal data from these services, they can use the system to map out internal network infrastructure and identify vulnerable internal systems.
Technical details
A Server-Side Request Forgery (SSRF) exists in the `imgPostURLInfo` function within `lxd/images.go`. When an authenticated user with the `can_create_images` entitlement imports an image via a URL, the LXD daemon performs HTTP HEAD and GET requests without validating the destination IP address. The underlying `RFC3493Dialer` fails to block loopback (127.0.0.1), RFC1918 private ranges, or cloud metadata endpoints (169.254.169.254). While hash validation prevents the direct exfiltration of response bodies, attackers can use error-based inference (e.g., "connection refused" vs "context deadline exceeded") to perform internal port scanning. The vulnerability is addressed in version 6.10.
Affected products
- Canonical LXD 4.12 through 6.9
Timeline
- 2026-06-15: other: Hardening documentation PR submitted to GitHub
- 2026-06-26: advisory: GHSA-3gq2-x4qg-p4g6 published by Canonical
- 2026-06-26: disclosed: CVE-2026-28385 published to NVD