PT-2026-31597 · Canonical+1 · Lxd+1

Miha Purg · Published 2026-04-09 · Updated 2026-05-13 · CVE-2026-34179

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.7

Description Canonical LXD versions 4.12 through 6.7 contain a flaw in the doCertificateUpdate function within lxd/certificates.go. This function fails to validate the Type field when processing PUT or PATCH requests to the /1.0/certificates/{fingerprint} API endpoint for restricted TLS certificate users. This allows a remote authenticated attacker to potentially escalate privileges to cluster admin.

Recommendations Update LXD to a version later than 6.7.

Exploit

Fix

LPE

Weakness Enumeration

CWE-915

Related Identifiers

BDU:2026-07539

CVE-2026-34179

GHSA-C3H3-89QF-JQM5

Affected Products

Lxd

Red Os

References · 20

• 🔥 https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5 · Exploit
• https://github.com/canonical/lxd/pull/17936 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34179 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34179 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3h3-89qf-jqm5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07539 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34179 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34179 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34179 · Security Note
• https://ubuntu.com/security/CVE-2026-34179 · Vendor Advisory
• https://github.com/canonical/lxd · Note
• https://twitter.com/CVEnew/status/2042186487836606940 · Twitter Post
• https://twitter.com/CveFindCom/status/2042199070983254271 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-lxd-cve-2026-34179-7.3 · Note
• https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-34179 · Note