Improper access control in LXD - CVE-2026-34179
Published: April 9, 2026
Vulnerability identifier: #VU125585
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34179
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to cluster admin.
The vulnerability exists due to improper access control in the doCertificateUpdate handler for the /1.0/certificates/{fingerprint} endpoint when processing PUT or PATCH requests that update TLS certificate records. A remote privileged user can send a crafted request to change the certificate type from client to server and escalate privileges to cluster admin.
The issue affects deployments using legacy restricted TLS certificates through the /1.0/certificates API, and the privilege change takes effect after the identity cache refresh.
Affected software
LXD
Debian Linux
lxd (Debian package)
incus (Debian package)
Debian Linux
lxd (Debian package)
incus (Debian package)
How to mitigate CVE-2026-34179
Install security update from vendor's website.
LXD - addressed in versions 5.0.7, 5.21.5, 6.8
lxd (Debian package) - addressed in versions 5.0.2+git20231211.1364ae4-9+deb13u5, 5.0.2-5+deb12u5
incus (Debian package) - update to 6.0.4-2+deb13u6
lxd (Debian package) - addressed in versions 5.0.2+git20231211.1364ae4-9+deb13u5, 5.0.2-5+deb12u5
incus (Debian package) - update to 6.0.4-2+deb13u6