Is CVE-2026-34179 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34179 being exploited in the wild.

How severe is CVE-2026-34179?

Critical severity, with a CVSS score of 9.1, published 9 April 2026.

Which products and versions are affected?

Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, = 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267, SEMVER:introduced=0, SEMVER:introduced=0.0.0-20210305023314-538ac3df036e,last_affected=0.0.0-20260226085519-736f34afb267.

Is there a fix for CVE-2026-34179?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34179 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-34179?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34179: Canonical LXD privilege escalation via certificate type modification

Q: Is there a fix for CVE-2026-34179?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-34179 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-34179?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34179 · Severity: critical · CVSS 9.1 · Published 2026-04-09

LXD is a system container and virtual machine manager used to run and manage Linux environments. A vulnerability in how it handles security certificates allows a user with restricted, low-level access to upgrade their own permissions to full administrator status. This allows an attacker to take complete control of the host server, potentially accessing sensitive data or disrupting all services running on the infrastructure.

Technologies: Canonical LXD, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2026-34179 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34179 being exploited in the wild.
How severe is CVE-2026-34179?: Critical severity, with a CVSS score of 9.1, published 9 April 2026.
Which products and versions are affected?: Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267; github.com/canonical/lxd (Go) >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267, SEMVER:introduced=0, SEMVER:introduced=0.0.0-20210305023314-538ac3df036e,last_affected=0.0.0-20260226085519-736f34afb267.
Is there a fix for CVE-2026-34179?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34179 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-34179?: Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in LXD's `doCertificateUpdate` function within `lxd/certificates.go`. The implementation fails to validate or reset the `Type` field when a restricted user performs a PUT or PATCH request to the `/1.0/certificates/{fingerprint}` endpoint. While other fields like `Restricted` and `Projects` are guarded, the `Type` field can be modified from `client` to `server`. Upon the next TLS authentication, the modified certificate is recognized as a server certificate, granting the user `ProtocolCluster` privileges and full cluster administration rights. This allows the attacker to create privileged containers and escape to the host system. Patches are available for LXD series 4.0, 5.0, 5.21, and 6.x.

Affected products

Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267

Identifiers

CVE-2026-34179
GHSA-c3h3-89qf-jqm5
GO-2026-5306

Timeline

2026-04-09: disclosed
2026-04-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.