An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6188 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6188-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 31, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : lxd     CVE ID         : CVE-2026-28384 CVE-2026-33542 CVE-2026-33897

    Multiple security issues were discovered in LXD, a system container     and virtual machine manager, which could result in privilege escalation     or the execution of arbitrary commands.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5.0.2-5+deb12u4.

    For the stable distribution (trixie), these problems have been fixed in     version 5.0.2+git20231211.1364ae4-9+deb13u4.

    We recommend that you upgrade your lxd packages.

    For the detailed security status of lxd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/lxd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6184 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6184-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 29, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : incus     CVE ID         : CVE-2026-28384 CVE-2026-33542 CVE-2026-33743

    Multiple security issues were discovered in Incus, a system container     and virtual machine manager, which could result in denial of service     or the execution of arbitrary commands.

    For the stable distribution (trixie), these problems have been fixed in     version 6.0.4-2+deb13u5.

    We recommend that you upgrade your incus packages.

    For the detailed security status of incus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/incus

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
304555	Debian dsa-6188 : golang-github-canonical-lxd-dev - security update	Nessus	Debian Local Security Checks	critical
304243	Debian dsa-6184 : golang-github-lxc-incus-dev - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2026-28384

critical

Tenable Plugins

critical

critical