CVE-2026-3351

EUVD-2026-9286
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
canonicallxd
6.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/canonical/lxd/commit/d936c90d47cf0be1e9757df897f769e9887ebde1
https://github.com/canonical/lxd/pull/17738
https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r