CVE-2026-28385: LXD: SSRF via image import from URL allows internal network probing by authenticated users
The LXD image import-from-URL endpoint (POST /1.0/images with source.type=url) makes server-side HTTP requests to an attacker-supplied URL without any private-IP or loopback blocking. An authenticated user with the can_create_images entitlement can force the LXD daemon to connect to internal network addresses (127.0.0.1, RFC1918 ranges, cloud metadata endpoints), enabling port scanning via error-based inference and interaction with internal HTTP services from the daemon’s privileged network position.
References
- github.com/advisories/GHSA-3gq2-x4qg-p4g6
- github.com/canonical/lxd/blob/lxd-6.10.0/lxd/image_source_transitional.go
- github.com/canonical/lxd/blob/lxd-6.9/lxd/daemon_images.go
- github.com/canonical/lxd/blob/lxd-6.9/lxd/images.go
- github.com/canonical/lxd/commit/08996fa031eebc2bc2f8e27148c2ba24386c01d0
- github.com/canonical/lxd/commit/4bbdb17ab67010446668e4b00a5175df5b6d55b4
- github.com/canonical/lxd/commit/5976c92117b79d73437d7fab55e34cb80083edff
- github.com/canonical/lxd/commit/886fcf5b7686bf59de78e239cec90a69e8fb9c65
- github.com/canonical/lxd/commit/c4a919f3f4e21249d535d4030a33484313026111
- github.com/canonical/lxd/pull/18210
- github.com/canonical/lxd/pull/18462
- github.com/canonical/lxd/releases/tag/lxd-6.9
- github.com/canonical/lxd/security/advisories/GHSA-3gq2-x4qg-p4g6
- nvd.nist.gov/vuln/detail/CVE-2026-28385
Code Behaviors & Features
Detect and mitigate CVE-2026-28385 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →