Executive brief
LXD is a system container and virtual machine manager used to run and manage Linux environments. A vulnerability in how it handles security certificates allows a user with restricted, low-level access to upgrade their own permissions to full administrator status. This allows an attacker to take complete control of the host server, potentially accessing sensitive data or disrupting all services running on the infrastructure.
Technical details
A privilege escalation vulnerability exists in LXD's `doCertificateUpdate` function within `lxd/certificates.go`. The implementation fails to validate or reset the `Type` field when a restricted user performs a PUT or PATCH request to the `/1.0/certificates/{fingerprint}` endpoint. While other fields like `Restricted` and `Projects` are guarded, the `Type` field can be modified from `client` to `server`. Upon the next TLS authentication, the modified certificate is recognized as a server certificate, granting the user `ProtocolCluster` privileges and full cluster administration rights. This allows the attacker to create privileged containers and escape to the host system. Patches are available for LXD series 4.0, 5.0, 5.21, and 6.x.
Affected products
- Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory