PT-2025-40326 · Canonical+2 · Lxd+2

Published 2025-10-02 · Updated 2025-11-17 · CVE-2025-54286

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 5.0 and later

Description A Cross-Site Request Forgery (CSRF) issue exists in LXD-UI. This allows an attacker to create and start container instances without user consent by submitting crafted HTML forms that exploit client certificate authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-54286

DSA-6027-1

DSA-6028-1

GHSA-P8HW-RFJG-689H

GO-2025-4003

OPENSUSE-SU-2025:15710-1

Affected Products

Debian

Lxd

Red Os

References · 96

• 🔥 https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h · Exploit
• https://osv.dev/vulnerability/DSA-6028-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54286 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54286 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54286 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54286 · Security Note
• https://osv.dev/vulnerability/GO-2025-4003 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8hw-rfjg-689h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54286 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-54286 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54286 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6027-1 · Vendor Advisory
• https://github.com/canonical/lxd · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note