« Volver al listado

CVE-2026-28384

Estado: AnalizadaCrítica (9.4)—

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto autenticado (PR:L, AV:N) a servicio LXD; CWE-78 (inyección de comandos) en parámetro compression_algorithm permite ejecución como daemon del servidor.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Canonical — LXD

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28384",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28384",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-13T16:30:00.719316Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@ubuntu.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "repo": "https://github.com/canonical/lxd",
          "vendor": "Canonical",
          "product": "lxd",
          "versions": [
            {
              "status": "affected",
              "version": "6.0",
              "lessThan": "6.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.21.0",
              "lessThan": "5.21.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.0.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.12"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "lxd",
          "programFiles": [
            "images.go",
            "instance_backup.go"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-12T15:16:27.247",
  "references": [
    {
      "url": "https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365",
      "tags": [
        "Issue Tracking",
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ubuntu.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10."
    },
    {
      "lang": "es",
      "value": "Una sanitización inadecuada del parámetro compression_algorithm en Canonical LXD permite a un usuario autenticado y sin privilegios ejecutar comandos como el demonio LXD en el servidor LXD a través de llamadas a la API a los puntos finales de imagen y copia de seguridad. Este problema afectó a LXD desde la versión 4.12 hasta la 6.6 y fue solucionado en las versiones snap 5.0.6-e49d9f4 (canal 5.0/stable), 5.21.4-1374f39 (canal 5.21/stable) y 6.7-1f11451 (canal 6.0 stable). El canal 4.0/stable no está afectado ya que contiene la versión 4.0.10."
    }
  ],
  "lastModified": "2026-09-18T14:08:53.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C143665B-F2E2-47C2-BCD5-53F45A0408E5",
              "versionEndExcluding": "5.0.6",
              "versionStartIncluding": "4.12"
            },
            {
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "873DE516-61FD-46A3-8C62-C9665C4A8563",
              "versionEndExcluding": "5.21.4",
              "versionStartIncluding": "5.21.0"
            },
            {
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3379FF55-2DB8-4EDF-8641-7ECB011F4F18",
              "versionEndExcluding": "6.7",
              "versionStartIncluding": "6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}