https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:10:24.209304+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07539 bdu:2026-07539 2026-10-08T16:10:24.212481+00:00 bdu:2026-07539 https://cve.radiocsirt.org/vuln/euvd-2026-290149 EUVD-2026-290149 2026-10-08T16:10:24.212522+00:00 EUVD-2026-290149 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34179 fkie_cve-2026-34179 2026-10-08T16:10:24.212538+00:00

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

 https://cve.radiocsirt.org/vuln/ghsa-c3h3-89qf-jqm5 GHSA-c3h3-89qf-jqm5 — LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin 2026-10-08T16:10:24.212570+00:00

Affected: Go: github.com/canonical/lxd

### Summary

A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from `client` to `server` via PUT/PATCH to `/1.0/certificates/{fingerprint}`. The non-admin guard and reset block in `doCertificateUpdate` fail to validate or reset the `Type` field, allowing a caller-supplied value to persist to the database. The modified certificate is matched as a server certificate during TLS authentication, granting `ProtocolCluster` with full admin privileges.

### Details

`doCertificateUpdate` in `lxd/certificates.go` handles PUT/PATCH requests to `/1.0/certificates/{fingerprint}` for both privileged and unprivileged callers. The access handler is `allowAuthenticated`, so any trusted TLS user (including restricted) can reach this code.

For unprivileged callers (restricted users who fail the `EntitlementCanEdit` check at line 975), two defenses are intended to prevent field tampering:

1. The guard block validates that `Restricted`, `Name`, and `Projects` match the original database record. Does not check `Type`. ```go // Ensure the user in not trying to change fields other than the certificate. if dbInfo.Restricted != req.Restricted || dbInfo.Name != req.Name || len(dbInfo.Projects) != len(req.Projects) { return response.Forbidden(errors.New("Only the certificate can be changed")) } ```

2. The reset block rebuilds the `dbCert` struct using original values for `Restricted`, `Name`, and `Certificate`. Uses `reqDBType` (caller-supp…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34179 UBUNTU-CVE-2026-34179 2026-10-08T16:10:24.212684+00:00

Affected: Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.