CVE-2026-28384

High

High exploit probability or critical severity with a known exploit.

CVSS base

9.9 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS — probability of exploitation (30 days)

0.6%

48.2th percentile

CISA KEV

Not listed

Weakness / dates

CWE-78

Published 2026-03-12 · modified 2026-09-18

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	C	Changed
Confidentiality	H	High
Integrity	H	High
Availability	H	High

Timeline

2026-03-12 — Published (NVD)
2026-09-18 — Last modified (NVD)

Description

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

Affected

canonical

References

Official: NVD · CVE.org