CVE-2025-54286
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.
- CVSS 4.0
- 7.5
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - CVSS 3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:lxd
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p8hw-rfjg-689h | Go | github.com/canonical/lxd | >=5.0 <5.0.5 | 5.0.5 |
| GHSA-p8hw-rfjg-689h | Go | github.com/canonical/lxd | >=5.1 <5.21.4 | 5.21.4 |
| GHSA-p8hw-rfjg-689h | Go | github.com/canonical/lxd | >=6.0 <6.5 | 6.5 |
| GHSA-p8hw-rfjg-689h | Go | github.com/canonical/lxd | >=0.0.0-20220401034332-1e1349e3cbf3 <0.0.0-20250827065555-0494f5d47e41 | 0.0.0-20250827065555-0494f5d47e41 |
| GO-2025-4003 | Go | github.com/canonical/lxd | all versions | no fix published |