# github.com/canonical/lxd (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-canonical-lxd Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-canonical-lxd.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in github.com/canonical/lxd (Go): 8 in the last 7 days and 8 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, LXD restricted project bypass leading to arbitrary command execution, was published on 6 November 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. 6 critical against 0. ## Counts - Last 7 days: 8 - Last 30 days: 8 - Last 90 days: 8 - All time: 26 (9 critical, 0 exploited in the wild) ## About github.com/canonical/lxd (Go) LXD is a system container hypervisor and REST API for managing lightweight virtual machines and containers. ## Latest github.com/canonical/lxd (Go) vulnerabilities - [LXD restricted project bypass leading to arbitrary command execution](https://junglewise.ai/threats/lxd-has-restricted-project-bypass-leading-to-arbitrary-command-9034cd45) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD project restriction bypass in custom volume copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-for-custom-volume-copy-across-d414fa7a) (high, CVSS 7.7, published 6 Nov 2026) - [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0) (high, CVSS 7.7, published 6 Nov 2026) - [Incus arbitrary file write via trusted image hash](https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-client-due-to-trusted-image-hash-072dacee) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD argument injection in backup compression algorithm](https://junglewise.ai/threats/lxd-has-argument-injection-in-backup-compression-algorithm-leading-to-50a60f2a) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD arbitrary file read and write via symlink in container image](https://junglewise.ai/threats/lxd-has-arbitrary-file-read-write-on-host-via-rootfs-symlink-in-6c2d77f1) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD arbitrary file read and write on host via templates symlink](https://junglewise.ai/threats/lxd-has-arbitrary-file-read-write-on-host-via-templates-symlink-in-497edb66) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD arbitrary file write on host via exec-output symlink](https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-host-via-exec-output-symlink-in-crafted-cf88efc7) (critical, CVSS 9.9, published 6 Nov 2026) - [CVE-2026-28385: Canonical LXD SSRF in image import functionality](https://junglewise.ai/threats/cve-2026-28385-canonical-lxd-ssrf-in-image-import-functionality) (medium, CVSS 5, published 26 Jun 2026) - [CVE-2026-9639: Canonical LXD denial of service via nil-pointer dereference in volume backup import](https://junglewise.ai/threats/cve-2026-9639-canonical-lxd-denial-of-service-via-nil-pointer-dereference-in) (medium, CVSS 6.5, published 26 Jun 2026) - [CVE-2026-12411: Canonical LXD broken access control in devLXDInstancePatchHandler](https://junglewise.ai/threats/cve-2026-12411-canonical-lxd-broken-access-control-in-devlxdinstancepatchhandler) (high, CVSS 8.4, published 26 Jun 2026) - [CVE-2026-34179: Canonical LXD privilege escalation via certificate type modification](https://junglewise.ai/threats/cve-2026-34179-canonical-lxd-privilege-escalation-via-certificate-type) (critical, CVSS 9.1, published 9 Apr 2026) - [CVE-2026-34178: Canonical LXD project restriction bypass via crafted backup import](https://junglewise.ai/threats/cve-2026-34178-canonical-lxd-project-restriction-bypass-via-crafted-backup) (critical, CVSS 9.1, published 9 Apr 2026) - [CVE-2026-34177: Canonical LXD VM restriction bypass in isVMLowLevelOptionForbidden](https://junglewise.ai/threats/cve-2026-34177-canonical-lxd-vm-restriction-bypass-in) (critical, CVSS 9.1, published 9 Apr 2026) - [CVE-2026-3351: lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints](https://junglewise.ai/threats/cve-2026-3351-lxd-s-non-recursive-certificate-listing-bypasses-per-object) (medium, CVSS 4, published 10 Mar 2026) - [GO-2025-4121 - LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd](https://junglewise.ai/threats/go-2025-4121-lxd-vulnerable-to-a-local-privilege-escalation-through-8fc51dbc) (info, published 18 Nov 2025) - [LXD vulnerable to a local privilege escalation through custom storage volumes](https://junglewise.ai/threats/lxd-vulnerable-to-a-local-privilege-escalation-through-custom-storage-712b2107) (medium, CVSS 4, published 13 Nov 2025) - [CVE-2025-54288: Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server](https://junglewise.ai/threats/cve-2025-54288-canonical-lxd-source-container-identification-vulnerability-via) (low, CVSS 3.1, published 5 Nov 2025) - [CVE-2025-54289: GO-2025-3999 - Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd](https://junglewise.ai/threats/cve-2025-54289-canonical-lxd-vulnerable-to-privilege-escalation-via-websocket) (low, CVSS 3.1, published 5 Nov 2025) - [CVE-2025-54293: GO-2025-4000 - Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in…](https://junglewise.ai/threats/cve-2025-54293-canonical-lxd-path-traversal-vulnerability-in-instance-log-file) (low, CVSS 3.1, published 5 Nov 2025) - [CVE-2025-54291: Canonical LXD Project Existence Determination Through Error Handling in Image Get Function](https://junglewise.ai/threats/cve-2025-54291-canonical-lxd-project-existence-determination-through-error) (low, CVSS 3.1, published 5 Nov 2025) - [CVE-2025-54286: GO-2025-4003 - CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd](https://junglewise.ai/threats/cve-2025-54286-canonical-lxd-csrf-vulnerability-when-using-client-certificate) (low, CVSS 3.1, published 5 Nov 2025) - [CVE-2025-54290: Canonical LXD Project Existence Determination Through Error Handling in Image Export Function](https://junglewise.ai/threats/cve-2025-54290-canonical-lxd-project-existence-determination-through-error) (medium, CVSS 4, published 5 Nov 2025) - [CVE-2024-6219: Canonical LXD privilege escalation in PKI mode TLS certificates](https://junglewise.ai/threats/cve-2024-6219-canonical-lxd-privilege-escalation-in-pki-mode-tls-certificates) (low, CVSS 3.8, published 9 Dec 2024) - [CVE-2024-6156: GO-2024-3312 - CA certificate sign check bypass in github.com/canonical/lxd](https://junglewise.ai/threats/cve-2024-6156-lxd-ca-certificate-sign-check-bypass) (low, CVSS 3.1, published 9 Dec 2024) ## Most severe github.com/canonical/lxd (Go) vulnerabilities - [LXD restricted project bypass leading to arbitrary command execution](https://junglewise.ai/threats/lxd-has-restricted-project-bypass-leading-to-arbitrary-command-9034cd45) (critical, CVSS 9.9, published 6 Nov 2026) - [Incus arbitrary file write via trusted image hash](https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-client-due-to-trusted-image-hash-072dacee) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD argument injection in backup compression algorithm](https://junglewise.ai/threats/lxd-has-argument-injection-in-backup-compression-algorithm-leading-to-50a60f2a) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD arbitrary file read and write via symlink in container image](https://junglewise.ai/threats/lxd-has-arbitrary-file-read-write-on-host-via-rootfs-symlink-in-6c2d77f1) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD arbitrary file read and write on host via templates symlink](https://junglewise.ai/threats/lxd-has-arbitrary-file-read-write-on-host-via-templates-symlink-in-497edb66) (critical, CVSS 9.9, published 6 Nov 2026) - [LXD arbitrary file write on host via exec-output symlink](https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-host-via-exec-output-symlink-in-crafted-cf88efc7) (critical, CVSS 9.9, published 6 Nov 2026) - [CVE-2026-34178: Canonical LXD project restriction bypass via crafted backup import](https://junglewise.ai/threats/cve-2026-34178-canonical-lxd-project-restriction-bypass-via-crafted-backup) (critical, CVSS 9.1, published 9 Apr 2026) - [CVE-2026-34177: Canonical LXD VM restriction bypass in isVMLowLevelOptionForbidden](https://junglewise.ai/threats/cve-2026-34177-canonical-lxd-vm-restriction-bypass-in) (critical, CVSS 9.1, published 9 Apr 2026) - [CVE-2026-34179: Canonical LXD privilege escalation via certificate type modification](https://junglewise.ai/threats/cve-2026-34179-canonical-lxd-privilege-escalation-via-certificate-type) (critical, CVSS 9.1, published 9 Apr 2026) - [CVE-2026-12411: Canonical LXD broken access control in devLXDInstancePatchHandler](https://junglewise.ai/threats/cve-2026-12411-canonical-lxd-broken-access-control-in-devlxdinstancepatchhandler) (high, CVSS 8.4, published 26 Jun 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. 6 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 8 | 6 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/canonical/lxd (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-canonical-lxd, 13 November 2026.