PT-2026-24958 · Canonical+1 · Lxd+1

Bugbunny-Research · Published 2026-03-12 · Updated 2026-04-20 · CVE-2026-28384

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.6

Description An improper sanitization of the compression algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. The vulnerable parameter compression algorithm can be exploited through API endpoints such as image and backup endpoints.

Recommendations Update to LXD snap version 5.0.6-e49d9f4 (channel 5.0/stable). Update to LXD snap version 5.21.4-1374f39 (channel 5.21/stable). Update to LXD snap version 6.7-1f11451 (channel 6.0 stable).

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-07208

CVE-2026-28384

GHSA-4RMF-RCP8-2R9G

Affected Products

Lxd

Red Os

References · 17

• 🔥 https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g · Exploit
• https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f · Patch
• https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9 · Patch
• https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052 · Patch
• https://osv.dev/vulnerability/CVE-2026-28384 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28384 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07208 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-28384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28384 · Security Note
• https://twitter.com/Cezar_H_Linux/status/2038357228684456135 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-lxd-cve-2026-28384-7.3 · Note
• https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-lxd-cve-2026-28384-8.0 · Note
• https://twitter.com/CVEnew/status/2032410962079433051 · Twitter Post
• https://twitter.com/0dayPublishing/status/2032115415241949615 · Twitter Post