Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-54286

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical LXD

Default version status: unaffected

  • 5.0 to < 5.0.5affected
  • 5.21 to < 5.21.4affected
  • 6.0 to < 6.5affected

References