An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6188 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6188-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 31, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : lxd     CVE ID         : CVE-2026-28384 CVE-2026-33542 CVE-2026-33897

    Multiple security issues were discovered in LXD, a system container     and virtual machine manager, which could result in privilege escalation     or the execution of arbitrary commands.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5.0.2-5+deb12u4.

    For the stable distribution (trixie), these problems have been fixed in     version 5.0.2+git20231211.1364ae4-9+deb13u4.

    We recommend that you upgrade your lxd packages.

    For the detailed security status of lxd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/lxd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6184 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6184-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 29, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : incus     CVE ID         : CVE-2026-28384 CVE-2026-33542 CVE-2026-33743

    Multiple security issues were discovered in Incus, a system container     and virtual machine manager, which could result in denial of service     or the execution of arbitrary commands.

    For the stable distribution (trixie), these problems have been fixed in     version 6.0.4-2+deb13u5.

    We recommend that you upgrade your incus packages.

    For the detailed security status of incus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/incus

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker
    to create and start container instances without user consent via crafted HTML form submissions exploiting
    client certificate authentication. (CVE-2025-54286)

  - Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker
    with instance configuration permissions to read arbitrary files on the host system via specially crafted
    snapshot pattern templates using the Pongo2 template engine. (CVE-2025-54287)

  - Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms
    allows attackers with root privileges within any container to impersonate other containers and obtain
    their metadata, configuration, and device information via spoofed process names in the command line.
    (CVE-2025-54288)

  - Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with
    read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket
    connection hijacking format (CVE-2025-54289)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated,     unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and     backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions     5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0     stable). The channel 4.0/stable is not affected as it contains version 4.0.10. (CVE-2026-28384)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304555	Debian dsa-6188 : golang-github-canonical-lxd-dev - security update	Nessus	Debian Local Security Checks	critical
304243	Debian dsa-6184 : golang-github-lxc-incus-dev - security update	Nessus	Debian Local Security Checks	critical
438878	Alpine: multiple incus packages: security update to 6.0.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
438878	Alpine: multiple incus packages: security update to 6.0.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
302534	Linux Distros Unpatched Vulnerability : CVE-2026-28384	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-28384

critical

Tenable Plugins

critical

critical

critical

critical

critical