Log in Start free

Vulnerability · Published Mar 12, 2026 · Assigned by canonical

CVE-2026-28384Authenticated RCE via unsanitized compression_algorithm

Critical 9.4

In plain English

A critical-severity OS command injection in lxd from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.7%top 46.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23incus6.0.6-r0ALPINE-CVE-2026-28384
Alpine:v3.24incus6.0.6-r0ALPINE-CVE-2026-28384
Debian:13incus6.0.4-2+deb13u5DSA-6184-1
Debian:13incus6.0.4-2+deb13u5DEBIAN-CVE-2026-28384
Debian:14incus6.0.6-1DEBIAN-CVE-2026-28384
Debian:12lxdno fix listedDEBIAN-CVE-2026-28384
Debian:12lxd5.0.2-5+deb12u4DSA-6188-1
Debian:13lxd5.0.2+git20231211.1364ae4-9+deb13u4DSA-6188-1
Debian:13lxd5.0.2+git20231211.1364ae4-9+deb13u4DEBIAN-CVE-2026-28384

Affected products (as reported)

VendorProductVersions
Canonical lxd 6.0 – before 6.75.21.0 – before 5.21.45.0.0 – before 5.0.64.12

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References