CVE-2026-28385 Overview
CVE-2026-28385 is a Server-Side Request Forgery (SSRF) vulnerability in Canonical LXD versions 4.12 through 6.9. The flaw resides in the image import functionality exposed through the /images endpoint. Authenticated users holding the can_create_images entitlement can supply arbitrary URLs, which the LXD daemon fetches without validating the destination address. This allows outbound requests to loopback interfaces, RFC1918 private ranges, and cloud metadata endpoints. Attackers can enumerate internal HTTP services and perform error-based port scanning from the daemon's network position. The issue is tracked under [CWE-918] and disclosed in GitHub Security Advisory GHSA-3gq2-x4qg-p4g6.
Critical Impact
Authenticated attackers can pivot from the LXD daemon to reach internal networks, cloud metadata services, and loopback-bound management interfaces.
Affected Products
- Canonical LXD 4.12 through 6.9
- LXD daemon image import subsystem (/images endpoint)
- Deployments granting the can_create_images entitlement to non-administrative users
Discovery Timeline
- 2026-06-26 - CVE-2026-28385 published to NVD
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-28385
Vulnerability Analysis
LXD accepts image imports from remote URL sources through its REST API. When a client submits a request to the /images endpoint with a URL-based source, the daemon initiates an outbound HTTP connection to fetch the image. The daemon performs this fetch from its own network context, which typically resides on the container host with access to management networks. Because the destination address is not filtered against restricted ranges, callers can direct the daemon at internal targets. Response timing and error messages returned to the caller reveal whether target ports are open, closed, or filtered.
Root Cause
The daemon lacks egress validation on user-supplied URLs. It does not resolve the hostname and check the resulting IP against denylists for loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Cloud metadata endpoints such as 169.254.169.254 remain reachable. This classifies as a standard SSRF pattern under [CWE-918].
Attack Vector
An authenticated user with the can_create_images entitlement submits an image creation request whose source URL points at an internal resource. The daemon connects to the specified host and port, returning distinct error responses based on the target's behavior. Attackers use this oracle to map internal services and probe cloud metadata APIs for credentials on AWS, Azure, and GCP instances. The exploit requires no user interaction and executes over the network. The fix is available in the upstream pull request 18462.
Detection Methods for CVE-2026-28385
Indicators of Compromise
- Outbound connections from the LXD daemon process to 127.0.0.1, 169.254.169.254, or RFC1918 addresses that do not host container image registries
- Repeated POST /1.0/images requests containing source.type=url with varying target hosts or ports
- LXD audit logs showing image import failures clustered around internal IP ranges
Detection Strategies
- Alert on LXD API calls to /1.0/images where the source.url field resolves to private, loopback, or link-local addresses
- Correlate LXD process network telemetry against expected image registry destinations and flag deviations
- Monitor for anomalous volumes of failed image imports from a single API token or user identity
Monitoring Recommendations
- Forward LXD daemon logs and API access logs to a centralized SIEM for retention and correlation
- Baseline normal image import destinations and alert on new outbound targets
- Track use of the can_create_images entitlement and review grants during periodic access reviews
How to Mitigate CVE-2026-28385
Immediate Actions Required
- Upgrade LXD to a version containing the fix from pull request 18462 once released by Canonical
- Audit accounts holding the can_create_images entitlement and revoke it from users who do not require image creation
- Restrict network egress from the LXD daemon to known image registry endpoints using host firewall rules
Patch Information
Canonical addressed the SSRF by adding destination address validation to the image import path. Refer to the GitHub Security Advisory GHSA-3gq2-x4qg-p4g6 for release version details and upgrade guidance.
Workarounds
- Deploy an egress filtering firewall or proxy that blocks LXD daemon connections to 127.0.0.0/8, 169.254.0.0/16, and RFC1918 ranges
- On cloud instances, enforce IMDSv2 or block metadata endpoint access from container hosts to protect instance credentials
- Limit the can_create_images role to trusted administrators until patched builds are deployed
# Example iptables egress restriction for the LXD daemon user
iptables -A OUTPUT -m owner --uid-owner lxd -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lxd -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lxd -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lxd -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lxd -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
