> CVE-2025-54286

« BACK_TO_HOME
PUBLISHED
2025-10-02 10:15
MODIFIED
2025-10-02 19:11
EPSS (Prob. Exploit)
0.13%
Top 97.6%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-p8hw-rfjg-689h HIGH

Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

AFFECTED PACKAGES:
GO / github.com/canonical/lxd
>= 0.0.0-20220401034332-1e1349e3cbf3, < 0.0.0-20250827065555-0494f5d47e41
Fixed in: 0.0.0-20250827065555-0494f5d47e41
GO / github.com/canonical/lxd
>= 6.0, < 6.5
Fixed in: 6.5
GO / github.com/canonical/lxd
>= 5.1, < 5.21.4
Fixed in: 5.21.4
GO / github.com/canonical/lxd
>= 5.0, < 5.0.5
Fixed in: 5.0.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

AFFECTED PACKAGES:
Unknown / Unknown
20 versions affected
ALIASES:
GHSA-p8hw-rfjg-689h, GO-2025-4003

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/10/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME