Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker
    to create and start container instances without user consent via crafted HTML form submissions exploiting
    client certificate authentication. (CVE-2025-54286)

  - Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker
    with instance configuration permissions to read arbitrary files on the host system via specially crafted
    snapshot pattern templates using the Pongo2 template engine. (CVE-2025-54287)

  - Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms
    allows attackers with root privileges within any container to impersonate other containers and obtain
    their metadata, configuration, and device information via spoofed process names in the command line.
    (CVE-2025-54288)

  - Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with
    read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket
    connection hijacking format (CVE-2025-54289)

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6027 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6027-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 17, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : incus     CVE ID         : CVE-2025-54286 CVE-2025-54287 CVE-2025-54288                      CVE-2025-54289 CVE-2025-54290 CVE-2025-54291                      CVE-2025-54293

    Multiple security issues were discovered in Incus, a system container     and virtual machine manager, which could result in file disclosure,     information disclosure, privilege escalation or cross-site request     forgery.

    For the stable distribution (trixie), these problems have been fixed in     version 6.0.4-2+deb13u1.

    We recommend that you upgrade your incus packages.

    For the detailed security status of incus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/incus

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with     read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket     connection hijacking format (CVE-2025-54289)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with
    read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket
    connection hijacking format (CVE-2025-54289)

ID	Name	Product	Family	Type	Severity
438878	Alpine: multiple incus packages: security update to 6.0.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
438878	Alpine: multiple incus packages: security update to 6.0.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
270713	Debian dsa-6027 : golang-github-lxc-incus-dev - security update	Nessus	Debian Local Security Checks	Local	high
269483	Linux Distros Unpatched Vulnerability : CVE-2025-54289	Nessus	Misc.	Local	high
435506	SCA: security update for github.com/canonical/lxd (GHSA-3g72-chj4-2228)	Tenable Cloud Security	SCA Checks	Local	high
435506	SCA: security update for github.com/canonical/lxd (GHSA-3g72-chj4-2228)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-54289

high

Tenable Plugins

critical

critical

high

high

high

high