CVE-2026-28384 Canonical CVE debrief

Who should care

LXD administrators and users, particularly those with unprivileged access, should assess their exposure and apply patches or mitigations as needed. This includes reviewing LXD environment configurations, verifying the integrity of LXD installations, and monitoring server logs for suspicious activity. Additionally, security teams should prioritize patching and mitigation efforts based on the critical severity level of the vulnerability.

Why it matters

Authenticated users can execute commands as the LXD daemon via API calls due to improper sanitization of the compression_algorithm parameter in Canonical LXD, affecting versions from 4.12 through 6.6.

• Command execution as the LXD daemon
• Potential for lateral movement within the LXD environment
• Need for verification of LXD version and patch application
• Potential impact on confidentiality, integrity, and availability

Technical summary

The vulnerability is caused by improper sanitization of the compression_algorithm parameter in Canonical LXD, allowing an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affects LXD versions from 4.12 through 6.6 and was fixed in specific snap versions. The vulnerability has a CVSS score of 9.4, indicating a critical severity level. Defenders should review and apply patches, restrict access to the LXD API, and monitor server logs for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Review and apply the available patches for LXD versions 4.12 through 6.6
• Restrict access to the LXD API to only trusted users
• Monitor LXD server logs for suspicious activity
• Verify the integrity of LXD installations and configurations
• Perform a thorough review of LXD environment configurations to identify potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Canonical has provided fixes for the issue in specific snap versions. The vulnerability was publicly disclosed on 2026-03-12 and has a CVSS score of 9.4, indicating a critical severity level. There are no known instances of this vulnerability being exploited in the wild, but defenders should verify the integrity of LXD installations and configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.