Spoofing attack in LXD - CVE-2025-54288
Published: October 21, 2025 / Updated: April 9, 2026
Vulnerability identifier: #VU117416
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-54288
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform spoofing attack.
The vulnerability exists due to the source container identification process in devLXD server uses process cmdline (command line) information when displaying process names. A remote user can use the "exec -a" command to spoof process name and impersonate another container.
Affected software
LXD
Debian Linux
lxd (Debian package)
incus (Debian package)
Debian Linux
lxd (Debian package)
incus (Debian package)
How to mitigate CVE-2025-54288
Install updates from vendor's website.
LXD - addressed in versions 5.0.5, 5.21.4, 6.5
lxd (Debian package) - addressed in versions 5.0.2+git20231211.1364ae4-9+deb13u1, 5.0.2-5+deb12u1
incus (Debian package) - update to 6.0.4-2+deb13u1
lxd (Debian package) - addressed in versions 5.0.2+git20231211.1364ae4-9+deb13u1, 5.0.2-5+deb12u1
incus (Debian package) - update to 6.0.4-2+deb13u1