Vulnerability · Published Oct 2, 2025 · Assigned by canonical
CVE-2025-54289Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
High 7.4
In plain English
A high-severity security flaw in LXD from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)7.4High
Exploit odds (30 days)0.2%top 88.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | incus | 6.0.6-r0 | ALPINE-CVE-2025-54289 |
| Alpine:v3.24 | incus | 6.0.6-r0 | ALPINE-CVE-2025-54289 |
| Debian:13 | incus | 6.0.4-2+deb13u1 | DSA-6027-1 |
| Debian:13 | incus | 6.0.4-2+deb13u1 | DEBIAN-CVE-2025-54289 |
| Debian:14 | incus | 6.0.5-1 | DEBIAN-CVE-2025-54289 |
| Debian:12 | lxd | no fix listed | DEBIAN-CVE-2025-54289 |
| Debian:13 | lxd | no fix listed | DEBIAN-CVE-2025-54289 |
| Go | github.com/canonical/lxd | no fix listed | GO-2025-3999 |
| Go | github.com/canonical/lxd | 5.21.4 | GHSA-3g72-chj4-2228 |
| Go | github.com/canonical/lxd | 0.0.0-20250827065555-0494f5d47e41 | GHSA-3g72-chj4-2228 |
| Go | github.com/canonical/lxd | 6.5 | GHSA-3g72-chj4-2228 |
Affected products (as reported)
Weakness: CWE-1385 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N