PT-2026-24958 · Canonical+1 · Lxd+1

Bugbunny-Research · CVE-2026-28384 · Publicado 2026-03-12 · Atualizado 2026-04-20

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.6

Description An improper sanitization of the compression algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. The vulnerable parameter compression algorithm can be exploited through API endpoints such as image and backup endpoints.

Recommendations Update to LXD snap version 5.0.6-e49d9f4 (channel 5.0/stable). Update to LXD snap version 5.21.4-1374f39 (channel 5.21/stable). Update to LXD snap version 6.7-1f11451 (channel 6.0 stable).

Exploit

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2026-07208

CVE-2026-28384

GHSA-4RMF-RCP8-2R9G

Produtos afetados

Lxd

Red Os

Referências · 19

• 🔥 https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28384.json · Exploit
• https://github.com/canonical/lxd · Nota
• https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052 · Correção
• https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9 · Correção
• https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f · Correção
• https://twitter.com/CVEnew/status/2032410962079433051 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28384 · Aviso do Fabricante
• https://twitter.com/Cezar_H_Linux/status/2038357228684456135 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28384 · Nota de Segurança
• https://twitter.com/CCBalert/status/2032473834004115544 · Publicação no Twitter
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-28384 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-lxd-cve-2026-28384-7.3 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-28384 · Aviso do Fabricante
• https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365 · Nota