CVE-2026-28385: SSRF via image import from URL allows internal network probing by authenticated users
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure LXD so that when importing an image from a URL source, the LXD daemon validates and restricts outbound destination IPs for the /images endpoint, blocking connections to loopback addresses, RFC1918 private ranges, and cloud metadata endpoints.
LXD image import (URL source) outbound destination IP validation/restriction for /images endpoint = Restrict outbound destination IP addresses to prevent loopback, RFC1918 private ranges, and cloud metadata endpoints
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28385?
CVE-2026-28385 has a medium severity rating of 5.
How do I fix CVE-2026-28385?
To mitigate CVE-2026-28385, ensure that only trusted users have the can_create_images entitlement and consider updating to a patched version of Canonical LXD.
What is the impact of CVE-2026-28385?
CVE-2026-28385 allows authenticated users to perform internal network probing through SSRF by using the image import functionality.
Who is affected by CVE-2026-28385?
CVE-2026-28385 affects users of Canonical LXD versions 4.12 through 6.9 that possess the can_create_images entitlement.
What exploitation vector is used in CVE-2026-28385?
CVE-2026-28385 relies on the image import from URL feature to enable SSRF exploitation.