CVE-2026-28384 — Vulnetix

CVE-2026-28384 PUBLISHED CVSS 9.399999618530273 CRITICAL

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

EPSS 0.25% · 48.9th percentile

Risk Scores

CVSS 4.0

9.399999618530273

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS Score

0.25%

48.9th percentile

Affected Products

Vendor	Product	Versions
Canonical	lxd	6.0, 5.0.0, 4.12

Exploit Intelligence

CIRCL seen: CVE-2026-28384 (circl-sighting)
CIRCL seen: CVE-2026-28384 (circl-sighting)
CIRCL seen: CVE-2026-28384 (circl-sighting)
https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052 (circl)
https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9 (circl)
https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f (circl)
https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365 (circl)
https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g (cve.org)

Timeline

Mar 12, 2026 CVE Published
Mar 12, 2026 PoC Published
Mar 13, 2026 EPSS Score
Mar 13, 2026 CVE Updated
Mar 14, 2026 EPSS Score
Mar 15, 2026 EPSS Score
Mar 16, 2026 EPSS Score
Mar 17, 2026 EPSS Score
Mar 17, 2026 Coalition ESS Score
Mar 18, 2026 EPSS Score
Mar 19, 2026 EPSS Score
Mar 20, 2026 EPSS Score

References

Open in Interactive Console →