https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:44:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-272076 EUVD-2026-272076 https://cve.radiocsirt.org/vuln/euvd-2026-272076 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54289 <p>Privilege Escalation in operations API in Canonical LXD &lt;6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format</p> <p>Privilege Escalation in operations API in Canonical LXD &lt;6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54289 https://cve.radiocsirt.org/vuln/ghsa-3g72-chj4-2228 <p><strong>Affected:</strong> Go: github.com/canonical/lxd</p> <p>### Impact LXD&#39;s operations API includes secret values necessary for WebSocket connections when retrieving information about running operations. These secret values are used for authentication of WebSocket connections for terminal and console sessions.</p> <p>Therefore, attackers with only read permissions can use secret values obtained from the operations API to hijack terminal or console sessions opened by other users. Through this hijacking, attackers can execute arbitrary commands inside instances with the victim&#39;s privileges.</p> <p>### Reproduction Steps</p> <p>1. Log in to LXD-UI using an account with read-only permissions 2. Open browser DevTools and execute the following JavaScript code</p> <p>Note that this JavaScript code uses the /1.0/events API to capture execution events for terminal startup, establishes a websocket connection with that secret, and sends touch /tmp/xxx to the data channel.</p> <p>```js (async () =&gt; { class LXDEventsSession { constructor(callback) { this.wsBase = `wss://${window.location.host}/1.0/events?type=operation&amp;all-p rojects=true`; this.eventsConn = new WebSocket(this.wsBase); this.eventsConn.onopen = (event) =&gt; { console.log(&#39;Events conn Opened&#39;); }; this.eventsConn.onmessage = (event) =&gt; { callback(event); }; }} class LXDWebSocketSession { constructor(operationId, secrets) { this.operationId = operationId; this.secrets = secrets; this.wsBase = `wss://${window.location.host}/1.0/operations/${operationId}/w ebsocket`; this.connections = {}; this.connections.data = ne…</p> <p><strong>Affected:</strong> Go: github.com/canonical/lxd</p> <p>### Impact LXD&#39;s operations API includes secret values necessary for WebSocket connections when retrieving information about running operations. These secret values are used for authentication of WebSocket connections for terminal and console sessions.</p> <p>Therefore, attackers with only read permissions can use secret values obtained from the operations API to hijack terminal or console sessions opened by other users. Through this hijacking, attackers can execute arbitrary commands inside instances with the victim&#39;s privileges.</p> <p>### Reproduction Steps</p> <p>1. Log in to LXD-UI using an account with read-only permissions 2. Open browser DevTools and execute the following JavaScript code</p> <p>Note that this JavaScript code uses the /1.0/events API to capture execution events for terminal startup, establishes a websocket connection with that secret, and sends touch /tmp/xxx to the data channel.</p> <p>```js (async () =&gt; { class LXDEventsSession { constructor(callback) { this.wsBase = `wss://${window.location.host}/1.0/events?type=operation&amp;all-p rojects=true`; this.eventsConn = new WebSocket(this.wsBase); this.eventsConn.onopen = (event) =&gt; { console.log(&#39;Events conn Opened&#39;); }; this.eventsConn.onmessage = (event) =&gt; { callback(event); }; }} class LXDWebSocketSession { constructor(operationId, secrets) { this.operationId = operationId; this.secrets = secrets; this.wsBase = `wss://${window.location.host}/1.0/operations/${operationId}/w ebsocket`; this.connections = {}; this.connections.data = ne…</p> https://cve.radiocsirt.org/vuln/ghsa-3g72-chj4-2228 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 <p>govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54289 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd</p> <p>Privilege Escalation in operations API in Canonical LXD &lt;6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd</p> <p>Privilege Escalation in operations API in Canonical LXD &lt;6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54289