In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the
    image import functionality allows authenticated users with the can_create_images entitlement to interact
    with internal network infrastructure via the /images endpoint. When importing an image from a URL source,
    the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to
    loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and
    unauthorized interaction with internal HTTP services from the daemon's network position. (CVE-2026-28385)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the     image import functionality allows authenticated users with the can_create_images entitlement to interact     with internal network infrastructure via the /images endpoint. When importing an image from a URL source,     the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to     loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and     unauthorized interaction with internal HTTP services from the daemon's network position. (CVE-2026-28385)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478625	SCA: security update for github.com/canonical/lxd (GHSA-3gq2-x4qg-p4g6)	Tenable Cloud Security	SCA Checks	Local	medium
478625	SCA: security update for github.com/canonical/lxd (GHSA-3gq2-x4qg-p4g6)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
323326	Linux Distros Unpatched Vulnerability : CVE-2026-28385	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-28385

medium

Tenable Plugins

medium

medium

medium