https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:12:21.878884+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-272078 EUVD-2026-272078 2026-10-03T19:12:21.967309+00:00 EUVD-2026-272078 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54286 fkie_cve-2025-54286 2026-10-03T19:12:21.967347+00:00

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

 https://cve.radiocsirt.org/vuln/ghsa-p8hw-rfjg-689h GHSA-p8hw-rfjg-689h — Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI 2026-10-03T19:12:21.967380+00:00

Affected: Go: github.com/canonical/lxd

### Description OIDC authentication uses cookies with the SameSite=Strict attribute, preventing cookies from being sent with requests from other sites. Therefore, CSRF does not occur as long as web services in a Same Site relationship (same eTLD+1) with the origin running LXD-UI are trusted.

However, since the SameSite concept does not apply to client certificates, CSRF protection that doesn't rely on the SameSite attribute is necessary.

Note that when using cross-origin fetch API, client certificates are not sent in no-cors mode due to CORS restrictions (according to the WHATWG Fetch specification(https://fetch.spec.whatwg.org/#credentials), client certificates are treated as credentials), making cross-site attacks using fetch API difficult unless CORS settings are vulnerable. However, since LXD's API parses request bodies as JSON even when `Content-Type` is `text/plain` or `application/x-www-form-urlencoded`, CSRF attacks exploiting HTML form submissions are possible.

### Reproduction Steps 1. Prepare a malicious website controlled by the attacker 2. Deploy the following HTML form to implement an attack that automatically creates instances when victims visit:

This exploit code automatically sends a JSON string as text/plain to create an instance when rendered.

Note that for this PoC to work, the specified profile (default) must have a Default instance storage pool configured. This is typically set in the default profile of projects created after storage pool creation…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media 2026-10-03T19:12:21.967432+00:00

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54286 Withdrawn: UBUNTU-CVE-2025-54286 2026-10-03T19:12:21.967475+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.