Home

Description

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

PUBLISHED Reserved 2026-03-26 | Published 2026-04-09 | Updated 2026-04-09 | Assigner canonical




CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-915 Improperly controlled modification of Dynamically-Determined object attributes

Product status

Default status
unaffected

4.12.0 (semver) before 5.0.7
affected

5.1.0 (semver) before 5.21.5
affected

6.0.0 (semver) before 6.8.0
affected

Credits

Miha Purg finder

References

github.com/...al/lxd/security/advisories/GHSA-c3h3-89qf-jqm5 exploit

github.com/...al/lxd/security/advisories/GHSA-c3h3-89qf-jqm5 (Update of type field in restricted TLS certificate allows privilege escalation to cluster admin) vdb-entry vendor-advisory

github.com/canonical/lxd/pull/17936 (Improve validation on certificate edit) patch issue-tracking

cve.org (CVE-2026-34179)

nvd.nist.gov (CVE-2026-34179)

Download JSON