CVE-2026-34179

Published: Apr 9, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: security@ubuntu.com (Secondary)

Description

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

Affected (3)

Products: Canonical: Lxd

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Lxd	From 4.12 to 5.0.6
Canonical Lxd	From 5.21.0 to 5.21.4
Canonical Lxd	From 6.0 to 6.7

Related CWEs

Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (3)

https://github.com/canonical/lxd/pull/17936

Source: security@ubuntu.com

Issue TrackingPatch

https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5

Source: security@ubuntu.com

ExploitThird Party Advisory

https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.