CVE-2026-28385: Canonical LXD SSRF in image import functionality

CVE-2026-28385 · Severity: medium · CVSS 5 · Published 2026-06-26

Canonical LXD, a tool used to manage system containers and virtual machines, contains a security flaw in how it imports images from web addresses. An authorized user can trick the system into connecting to internal network services, such as private databases or cloud management interfaces, that should normally be inaccessible. While the attacker cannot directly steal data from these services, they can use the system to map out internal network infrastructure and identify vulnerable internal systems.

Technologies: Canonical LXD, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2026-28385 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28385 being exploited in the wild.
How severe is CVE-2026-28385?
Medium severity, with a CVSS score of 5, published 26 June 2026.
Which products and versions are affected?
Canonical LXD 4.12 through 6.9; github.com/canonical/lxd (Go) < 0.0.0-20261005133302-c4a919f3f4e2, SEMVER:introduced=0,fixed=0.0.0-20261005133302-c4a919f3f4e2.
Is there a fix for CVE-2026-28385?
Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20261005133302-c4a919f3f4e2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28385 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28385?
Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/canonical/lxd (Go): upgrade to 0.0.0-20261005133302-c4a919f3f4e2 or later
    go get github.com/canonical/lxd@v0.0.0-20261005133302-c4a919f3f4e2

Technical details

A Server-Side Request Forgery (SSRF) exists in the `imgPostURLInfo` function within `lxd/images.go`. When an authenticated user with the `can_create_images` entitlement imports an image via a URL, the LXD daemon performs HTTP HEAD and GET requests without validating the destination IP address. The underlying `RFC3493Dialer` fails to block loopback (127.0.0.1), RFC1918 private ranges, or cloud metadata endpoints (169.254.169.254). While hash validation prevents the direct exfiltration of response bodies, attackers can use error-based inference (e.g., "connection refused" vs "context deadline exceeded") to perform internal port scanning. The vulnerability is addressed in version 6.10.

Affected products

  • Canonical LXD 4.12 through 6.9

Identifiers

  • CVE-2026-28385
  • GHSA-3gq2-x4qg-p4g6

Timeline

  • 2026-06-15: other: Hardening documentation PR submitted to GitHub
  • 2026-06-26: advisory: GHSA-3gq2-x4qg-p4g6 published by Canonical
  • 2026-06-26: disclosed: CVE-2026-28385 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.