https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:32:03.671136+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-253952 EUVD-2026-253952 2026-10-02T16:32:03.752918+00:00 EUVD-2026-253952 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54288 fkie_cve-2025-54288 2026-10-02T16:32:03.752963+00:00

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

 https://cve.radiocsirt.org/vuln/ghsa-7232-97c6-j525 GHSA-7232-97c6-j525 — Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server 2026-10-02T16:32:03.753010+00:00

Affected: Go: github.com/canonical/lxd

### Impact In LXD's devLXD server, the source container identification process uses process cmdline (command line) information, allowing attackers to impersonate other containers by spoofing process names.

The core issue lies in the findContainerForPID function in `lxd/api_devlxd.go`. This function identifies senders through two steps as shown below:

1. cmdline-based identification: Check while tracing back through parent processes, and if it starts with `[lxc monitor]`, extract the project name and container name from that process name in the format projectName_containerName. 2. PID namespace-based identification: If not found in Step 1, check against all containers' PID namespaces.

https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/api_devlxd.go#L166-L276

Attackers can exploit Step 1 processing to impersonate arbitrary containers across projects by spoofing process names.

### Reproduction Steps 1. Access devLXD server from a normal container (e.g., EEEE):

``` root@EEEE:~# curl --unix-socket /dev/lxd/sock http://lxd-host/1.0/meta-data instance-id: 9f928574-2561-4eff-af82-a68e57d3c68b local-hostname: EEEE ```

2. Use exec -a to spoof process name and impersonate another container (DDDD):

``` root@EEEE:~# bash -c "exec -a '[lxc monitor]' curl --unix-socket /dev/lxd/sock http://lxd-host/1.0/meta-data -x 'test-project_DDDD'" instance-id: 1bb2f1c3-3ad2-4cd6-9965-67b14c3582cc local-hostname: DDDD ```

This attack successfully obtains metada…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media 2026-10-02T16:32:03.753131+00:00

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54288 UBUNTU-CVE-2025-54288 2026-10-02T16:32:03.753214+00:00

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.