{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-3351", "tracking": { "current_release_date": "2026-03-26T01:21:26.139587Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-3351", "initial_release_date": "2026-03-03T13:26:24.048891Z", "revision_history": [ { "date": "2026-03-03T13:26:24.048891Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-03T13:26:34.048139Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-03T13:38:46.788902Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)." }, { "date": "2026-03-03T13:38:53.708444Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-03T15:38:53.937576Z", "number": "5", "summary": "Unknown change." }, { "date": "2026-03-03T16:01:37.628188Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-04T15:15:17.425107Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-04T15:15:19.518256Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-03-04T20:39:47.320978Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-03-04T20:39:48.973289Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-03-05T00:12:51.440454Z", "number": "11", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4).| CWES updated (1)." }, { "date": "2026-03-05T18:39:04.313105Z", "number": "12", "summary": "Products created (1).| Products removed (1)." }, { "date": "2026-03-05T18:39:07.434428Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-03-11T19:24:52.923927Z", "number": "14", "summary": "CVSS created.| Products connected (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-03-11T19:24:57.093078Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-03-18T00:43:08.781323Z", "number": "16", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-03-18T00:43:17.558772Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:29:06.875099Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:29:13.365914Z", "number": "19", "summary": "NCSC Score updated." }, { "date": "2026-03-25T18:15:03.425460Z", "number": "20", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (3)." }, { "date": "2026-03-25T18:15:05.254521Z", "number": "21", "summary": "NCSC Score updated." }, { "date": "2026-03-25T21:44:30.968618Z", "number": "22", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (153).| References created (3)." } ], "status": "interim", "version": "22" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/6.6", "product": { "name": "vers:unknown/6.6", "product_id": "CSAFPID-5756674", "product_identification_helper": { "cpe": "cpe:2.3:a:canonical:lxd:6.6:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<0.0.0-20260224152359-d936c90d47cf", "product": { "name": "vers:unknown/>=0|<0.0.0-20260224152359-d936c90d47cf", "product_id": "CSAFPID-5759449" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.1", "product": { "name": "vers:unknown/lxd-0.1", "product_id": "CSAFPID-3658261" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.10", "product": { "name": "vers:unknown/lxd-0.10", "product_id": "CSAFPID-3658262" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.11", "product": { "name": "vers:unknown/lxd-0.11", "product_id": "CSAFPID-3658263" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.12", "product": { "name": "vers:unknown/lxd-0.12", "product_id": "CSAFPID-3658264" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.13", "product": { "name": "vers:unknown/lxd-0.13", "product_id": "CSAFPID-3658265" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.14", "product": { "name": "vers:unknown/lxd-0.14", "product_id": "CSAFPID-3658266" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.15", "product": { "name": "vers:unknown/lxd-0.15", "product_id": "CSAFPID-3658267" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.16", "product": { "name": "vers:unknown/lxd-0.16", "product_id": "CSAFPID-3658268" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.17", "product": { "name": "vers:unknown/lxd-0.17", "product_id": "CSAFPID-3658269" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.18", "product": { "name": "vers:unknown/lxd-0.18", "product_id": "CSAFPID-3658270" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.19", "product": { "name": "vers:unknown/lxd-0.19", "product_id": "CSAFPID-3658271" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.2", "product": { "name": "vers:unknown/lxd-0.2", "product_id": "CSAFPID-3658272" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.20", "product": { "name": "vers:unknown/lxd-0.20", "product_id": "CSAFPID-3658273" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.21", "product": { "name": "vers:unknown/lxd-0.21", "product_id": "CSAFPID-3658274" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.22", "product": { "name": "vers:unknown/lxd-0.22", "product_id": "CSAFPID-3658275" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.23", "product": { "name": "vers:unknown/lxd-0.23", "product_id": "CSAFPID-3658276" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.24", "product": { "name": "vers:unknown/lxd-0.24", "product_id": "CSAFPID-3658277" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.25", "product": { "name": "vers:unknown/lxd-0.25", "product_id": "CSAFPID-3658278" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.26", "product": { "name": "vers:unknown/lxd-0.26", "product_id": "CSAFPID-3658279" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.27", "product": { "name": "vers:unknown/lxd-0.27", "product_id": "CSAFPID-3658280" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.3", "product": { "name": "vers:unknown/lxd-0.3", "product_id": "CSAFPID-3658281" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.4", "product": { "name": "vers:unknown/lxd-0.4", "product_id": "CSAFPID-3658282" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.5", "product": { "name": "vers:unknown/lxd-0.5", "product_id": "CSAFPID-3658283" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.6", "product": { "name": "vers:unknown/lxd-0.6", "product_id": "CSAFPID-3658284" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.7", "product": { "name": "vers:unknown/lxd-0.7", "product_id": "CSAFPID-3658285" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.8", "product": { "name": "vers:unknown/lxd-0.8", "product_id": "CSAFPID-3658286" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.8.1", "product": { "name": "vers:unknown/lxd-0.8.1", "product_id": "CSAFPID-3658287" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-0.9", "product": { "name": "vers:unknown/lxd-0.9", "product_id": "CSAFPID-3658288" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0", "product": { "name": "vers:unknown/lxd-2.0.0", "product_id": "CSAFPID-3658289" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.beta1", "product": { "name": "vers:unknown/lxd-2.0.0.beta1", "product_id": "CSAFPID-3658290" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.beta2", "product": { "name": "vers:unknown/lxd-2.0.0.beta2", "product_id": "CSAFPID-3658291" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.beta3", "product": { "name": "vers:unknown/lxd-2.0.0.beta3", "product_id": "CSAFPID-3658292" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.beta4", "product": { "name": "vers:unknown/lxd-2.0.0.beta4", "product_id": "CSAFPID-3658293" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc1", "product": { "name": "vers:unknown/lxd-2.0.0.rc1", "product_id": "CSAFPID-3658294" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc2", "product": { "name": "vers:unknown/lxd-2.0.0.rc2", "product_id": "CSAFPID-3658295" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc3", "product": { "name": "vers:unknown/lxd-2.0.0.rc3", "product_id": "CSAFPID-3658296" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc4", "product": { "name": "vers:unknown/lxd-2.0.0.rc4", "product_id": "CSAFPID-3658297" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc5", "product": { "name": "vers:unknown/lxd-2.0.0.rc5", "product_id": "CSAFPID-3658298" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc6", "product": { "name": "vers:unknown/lxd-2.0.0.rc6", "product_id": "CSAFPID-3658299" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc7", "product": { "name": "vers:unknown/lxd-2.0.0.rc7", "product_id": "CSAFPID-3658300" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc8", "product": { "name": "vers:unknown/lxd-2.0.0.rc8", "product_id": "CSAFPID-3658301" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.0.0.rc9", "product": { "name": "vers:unknown/lxd-2.0.0.rc9", "product_id": "CSAFPID-3658302" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.1", "product": { "name": "vers:unknown/lxd-2.1", "product_id": "CSAFPID-3658303" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.10", "product": { "name": "vers:unknown/lxd-2.10", "product_id": "CSAFPID-3658304" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.10.1", "product": { "name": "vers:unknown/lxd-2.10.1", "product_id": "CSAFPID-3658305" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.11", "product": { "name": "vers:unknown/lxd-2.11", "product_id": "CSAFPID-3658306" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.12", "product": { "name": "vers:unknown/lxd-2.12", "product_id": "CSAFPID-3658307" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.13", "product": { "name": "vers:unknown/lxd-2.13", "product_id": "CSAFPID-3658308" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.14", "product": { "name": "vers:unknown/lxd-2.14", "product_id": "CSAFPID-3658309" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.15", "product": { "name": "vers:unknown/lxd-2.15", "product_id": "CSAFPID-3658310" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.16", "product": { "name": "vers:unknown/lxd-2.16", "product_id": "CSAFPID-3658311" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.17", "product": { "name": "vers:unknown/lxd-2.17", "product_id": "CSAFPID-3658312" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.18", "product": { "name": "vers:unknown/lxd-2.18", "product_id": "CSAFPID-3658313" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.19", "product": { "name": "vers:unknown/lxd-2.19", "product_id": "CSAFPID-3658314" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.2", "product": { "name": "vers:unknown/lxd-2.2", "product_id": "CSAFPID-3658315" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.20", "product": { "name": "vers:unknown/lxd-2.20", "product_id": "CSAFPID-3658316" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.21", "product": { "name": "vers:unknown/lxd-2.21", "product_id": "CSAFPID-3658317" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.3", "product": { "name": "vers:unknown/lxd-2.3", "product_id": "CSAFPID-3658318" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.4", "product": { "name": "vers:unknown/lxd-2.4", "product_id": "CSAFPID-3658319" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.4.1", "product": { "name": "vers:unknown/lxd-2.4.1", "product_id": "CSAFPID-3658320" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.5", "product": { "name": "vers:unknown/lxd-2.5", "product_id": "CSAFPID-3658321" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.6", "product": { "name": "vers:unknown/lxd-2.6", "product_id": "CSAFPID-3658322" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.6.1", "product": { "name": "vers:unknown/lxd-2.6.1", "product_id": "CSAFPID-3658323" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.6.2", "product": { "name": "vers:unknown/lxd-2.6.2", "product_id": "CSAFPID-3658324" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.7", "product": { "name": "vers:unknown/lxd-2.7", "product_id": "CSAFPID-3658325" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.8", "product": { "name": "vers:unknown/lxd-2.8", "product_id": "CSAFPID-3658326" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.9", "product": { "name": "vers:unknown/lxd-2.9", "product_id": "CSAFPID-3658327" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.9.1", "product": { "name": "vers:unknown/lxd-2.9.1", "product_id": "CSAFPID-3658328" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.9.2", "product": { "name": "vers:unknown/lxd-2.9.2", "product_id": "CSAFPID-3658329" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-2.9.3", "product": { "name": "vers:unknown/lxd-2.9.3", "product_id": "CSAFPID-3658330" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0", "product": { "name": "vers:unknown/lxd-3.0.0", "product_id": "CSAFPID-3658331" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta1", "product": { "name": "vers:unknown/lxd-3.0.0.beta1", "product_id": "CSAFPID-3658332" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta2", "product": { "name": "vers:unknown/lxd-3.0.0.beta2", "product_id": "CSAFPID-3658333" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta3", "product": { "name": "vers:unknown/lxd-3.0.0.beta3", "product_id": "CSAFPID-3658334" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta4", "product": { "name": "vers:unknown/lxd-3.0.0.beta4", "product_id": "CSAFPID-3658335" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta5", "product": { "name": "vers:unknown/lxd-3.0.0.beta5", "product_id": "CSAFPID-3658336" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta6", "product": { "name": "vers:unknown/lxd-3.0.0.beta6", "product_id": "CSAFPID-3658337" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.0.0.beta7", "product": { "name": "vers:unknown/lxd-3.0.0.beta7", "product_id": "CSAFPID-3658338" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.1", "product": { "name": "vers:unknown/lxd-3.1", "product_id": "CSAFPID-3658339" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.10", "product": { "name": "vers:unknown/lxd-3.10", "product_id": "CSAFPID-3658340" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.11", "product": { "name": "vers:unknown/lxd-3.11", "product_id": "CSAFPID-3658341" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.12", "product": { "name": "vers:unknown/lxd-3.12", "product_id": "CSAFPID-3658342" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.13", "product": { "name": "vers:unknown/lxd-3.13", "product_id": "CSAFPID-3658343" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.14", "product": { "name": "vers:unknown/lxd-3.14", "product_id": "CSAFPID-3658344" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.15", "product": { "name": "vers:unknown/lxd-3.15", "product_id": "CSAFPID-3658345" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.16", "product": { "name": "vers:unknown/lxd-3.16", "product_id": "CSAFPID-3658346" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.17", "product": { "name": "vers:unknown/lxd-3.17", "product_id": "CSAFPID-3658347" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.18", "product": { "name": "vers:unknown/lxd-3.18", "product_id": "CSAFPID-3658348" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.19", "product": { "name": "vers:unknown/lxd-3.19", "product_id": "CSAFPID-3658349" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.2", "product": { "name": "vers:unknown/lxd-3.2", "product_id": "CSAFPID-3658350" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.20", "product": { "name": "vers:unknown/lxd-3.20", "product_id": "CSAFPID-3658351" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.21", "product": { "name": "vers:unknown/lxd-3.21", "product_id": "CSAFPID-3658352" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.22", "product": { "name": "vers:unknown/lxd-3.22", "product_id": "CSAFPID-3658353" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.23", "product": { "name": "vers:unknown/lxd-3.23", "product_id": "CSAFPID-3658354" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.3", "product": { "name": "vers:unknown/lxd-3.3", "product_id": "CSAFPID-3658355" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.4", "product": { "name": "vers:unknown/lxd-3.4", "product_id": "CSAFPID-3658356" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.5", "product": { "name": "vers:unknown/lxd-3.5", "product_id": "CSAFPID-3658357" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.6", "product": { "name": "vers:unknown/lxd-3.6", "product_id": "CSAFPID-3658358" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.7", "product": { "name": "vers:unknown/lxd-3.7", "product_id": "CSAFPID-3658359" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.8", "product": { "name": "vers:unknown/lxd-3.8", "product_id": "CSAFPID-3658360" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-3.9", "product": { "name": "vers:unknown/lxd-3.9", "product_id": "CSAFPID-3658361" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.0.0", "product": { "name": "vers:unknown/lxd-4.0.0", "product_id": "CSAFPID-3658087" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.1", "product": { "name": "vers:unknown/lxd-4.1", "product_id": "CSAFPID-3658362" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.10", "product": { "name": "vers:unknown/lxd-4.10", "product_id": "CSAFPID-3658363" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.11", "product": { "name": "vers:unknown/lxd-4.11", "product_id": "CSAFPID-3658364" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.12", "product": { "name": "vers:unknown/lxd-4.12", "product_id": "CSAFPID-3658365" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.13", "product": { "name": "vers:unknown/lxd-4.13", "product_id": "CSAFPID-3658366" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.14", "product": { "name": "vers:unknown/lxd-4.14", "product_id": "CSAFPID-3658367" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.15", "product": { "name": "vers:unknown/lxd-4.15", "product_id": "CSAFPID-3658368" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.16", "product": { "name": "vers:unknown/lxd-4.16", "product_id": "CSAFPID-3658369" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.17", "product": { "name": "vers:unknown/lxd-4.17", "product_id": "CSAFPID-3658370" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.18", "product": { "name": "vers:unknown/lxd-4.18", "product_id": "CSAFPID-3658371" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.19", "product": { "name": "vers:unknown/lxd-4.19", "product_id": "CSAFPID-3658372" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.2", "product": { "name": "vers:unknown/lxd-4.2", "product_id": "CSAFPID-3658373" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.20", "product": { "name": "vers:unknown/lxd-4.20", "product_id": "CSAFPID-3658374" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.21", "product": { "name": "vers:unknown/lxd-4.21", "product_id": "CSAFPID-3658375" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.22", "product": { "name": "vers:unknown/lxd-4.22", "product_id": "CSAFPID-3658376" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.23", "product": { "name": "vers:unknown/lxd-4.23", "product_id": "CSAFPID-3658377" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.24", "product": { "name": "vers:unknown/lxd-4.24", "product_id": "CSAFPID-3658378" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.3", "product": { "name": "vers:unknown/lxd-4.3", "product_id": "CSAFPID-3658379" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.4", "product": { "name": "vers:unknown/lxd-4.4", "product_id": "CSAFPID-3658380" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.5", "product": { "name": "vers:unknown/lxd-4.5", "product_id": "CSAFPID-3658381" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.6", "product": { "name": "vers:unknown/lxd-4.6", "product_id": "CSAFPID-3658382" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.7", "product": { "name": "vers:unknown/lxd-4.7", "product_id": "CSAFPID-3658383" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.8", "product": { "name": "vers:unknown/lxd-4.8", "product_id": "CSAFPID-3658384" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-4.9", "product": { "name": "vers:unknown/lxd-4.9", "product_id": "CSAFPID-3658385" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.0.0", "product": { "name": "vers:unknown/lxd-5.0.0", "product_id": "CSAFPID-3658386" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.1", "product": { "name": "vers:unknown/lxd-5.1", "product_id": "CSAFPID-3658387" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.10", "product": { "name": "vers:unknown/lxd-5.10", "product_id": "CSAFPID-3658388" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.11", "product": { "name": "vers:unknown/lxd-5.11", "product_id": "CSAFPID-3658389" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.12", "product": { "name": "vers:unknown/lxd-5.12", "product_id": "CSAFPID-3658390" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.13", "product": { "name": "vers:unknown/lxd-5.13", "product_id": "CSAFPID-3658391" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.14", "product": { "name": "vers:unknown/lxd-5.14", "product_id": "CSAFPID-3658392" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.15", "product": { "name": "vers:unknown/lxd-5.15", "product_id": "CSAFPID-3658393" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.16", "product": { "name": "vers:unknown/lxd-5.16", "product_id": "CSAFPID-3658394" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.17", "product": { "name": "vers:unknown/lxd-5.17", "product_id": "CSAFPID-3658395" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.18", "product": { "name": "vers:unknown/lxd-5.18", "product_id": "CSAFPID-3658396" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.19", "product": { "name": "vers:unknown/lxd-5.19", "product_id": "CSAFPID-3658397" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.2", "product": { "name": "vers:unknown/lxd-5.2", "product_id": "CSAFPID-3658398" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.20", "product": { "name": "vers:unknown/lxd-5.20", "product_id": "CSAFPID-3658399" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.3", "product": { "name": "vers:unknown/lxd-5.3", "product_id": "CSAFPID-3658401" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.4", "product": { "name": "vers:unknown/lxd-5.4", "product_id": "CSAFPID-3658402" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.5", "product": { "name": "vers:unknown/lxd-5.5", "product_id": "CSAFPID-3658403" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.6", "product": { "name": "vers:unknown/lxd-5.6", "product_id": "CSAFPID-3658404" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.7", "product": { "name": "vers:unknown/lxd-5.7", "product_id": "CSAFPID-3658405" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.8", "product": { "name": "vers:unknown/lxd-5.8", "product_id": "CSAFPID-3658406" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-5.9", "product": { "name": "vers:unknown/lxd-5.9", "product_id": "CSAFPID-3658407" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-6.1", "product": { "name": "vers:unknown/lxd-6.1", "product_id": "CSAFPID-5006310" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-6.2", "product": { "name": "vers:unknown/lxd-6.2", "product_id": "CSAFPID-5006311" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-6.3", "product": { "name": "vers:unknown/lxd-6.3", "product_id": "CSAFPID-5006312" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-6.4", "product": { "name": "vers:unknown/lxd-6.4", "product_id": "CSAFPID-5006313" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-6.5", "product": { "name": "vers:unknown/lxd-6.5", "product_id": "CSAFPID-5617484" } }, { "category": "product_version_range", "name": "vers:unknown/lxd-6.6", "product": { "name": "vers:unknown/lxd-6.6", "product_id": "CSAFPID-5617485" } } ], "category": "product_name", "name": "LXD" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/6.6", "product": { "name": "vers:unknown/6.6", "product_id": "CSAFPID-5763350" } } ], "category": "product_name", "name": "lxd" } ], "category": "vendor", "name": "Canonical" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-1396424" } } ], "category": "product_name", "name": "lxd" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3351", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "description", "text": "Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-3351" }, { "category": "description", "text": "Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-3351" }, { "category": "description", "text": "## Summary\nThe `GET /1.0/certificates` endpoint (non-recursive mode) returns URLs containing fingerprints for all certificates in the trust store, bypassing the per-object `can_view` authorization check that is correctly applied in the recursive path. Any authenticated identity — including restricted, non-admin users — can enumerate all certificate fingerprints, exposing the full set of trusted identities in the LXD deployment.\n\n## Affected Component\n- `lxd/certificates.go` — `certificatesGet` (lines 185–192) — Non-recursive code path returns unfiltered certificate list.\n\n## CWE\n- **CWE-862**: Missing Authorization\n\n## Description\n\n### Core vulnerability: missing permission filter in non-recursive listing path\n\nThe `certificatesGet` handler obtains a permission checker at line 143 and correctly applies it when building the recursive response (lines 163-176). However, the non-recursive code path at lines 185-192 creates a fresh loop over the unfiltered `baseCerts` slice, completely bypassing the authorization check:\n\n```go\n// lxd/certificates.go:139-193\nfunc certificatesGet(d *Daemon, r *http.Request) response.Response {\n recursion := util.IsRecursionRequest(r)\n s := d.State()\n\n userHasPermission, err := s.Authorizer.GetPermissionChecker(r.Context(), auth.EntitlementCanView, entity.TypeCertificate)\n // ...\n\n for _, baseCert := range baseCerts {\n if !userHasPermission(entity.CertificateURL(baseCert.Fingerprint)) {\n continue // Correctly filters unauthorized certs\n }\n\n if recursion {\n // ... builds filtered certResponses ...\n }\n // NOTE: when !recursion, nothing is recorded — the filter result is discarded\n }\n\n if !recursion {\n body := []string{}\n for _, baseCert := range baseCerts { // <-- iterates UNFILTERED baseCerts\n certificateURL := api.NewURL().Path(version.APIVersion, \"certificates\", baseCert.Fingerprint).String()\n body = append(body, certificateURL)\n }\n return response.SyncResponse(true, body) // Returns ALL certificate fingerprints\n }\n\n return response.SyncResponse(true, certResponses) // Recursive path is correctly filtered\n}\n```\n\n### Inconsistency with other list endpoints confirms the bug\n\nFive other list endpoints in the same codebase correctly filter results in both recursive and non-recursive paths:\n\n| Endpoint | File | Filters non-recursive? |\n|----------|------|----------------------|\n| Instances | `lxd/instances_get.go` — `instancesGet` | Yes — filters before either path |\n| Images | `lxd/images.go` — `doImagesGet` | Yes — checks `hasPermission` for both paths |\n| Networks | `lxd/networks.go` — `networksGet` | Yes — filters outside recursion check |\n| Profiles | `lxd/profiles.go` — `profilesGet` | Yes — separate filter in non-recursive path |\n| **Certificates** | **`lxd/certificates.go` — `certificatesGet`** | **No — unfiltered** |\n\nThe certificates endpoint is the sole outlier, confirming this is an oversight rather than a design choice.\n\n### Access handler provides no defense\n\nThe endpoint uses `allowAuthenticated` as its `AccessHandler` (`certificates.go:45`), which only checks `requestor.IsTrusted()`:\n\n```go\n// lxd/daemon.go:255-267\n// allowAuthenticated is an AccessHandler which allows only authenticated requests.\n// This should be used in conjunction with further access control within the handler\n// (e.g. to filter resources the user is able to view/edit).\nfunc allowAuthenticated(_ *Daemon, r *http.Request) response.Response {\n requestor, err := request.GetRequestor(r.Context())\n // ...\n if requestor.IsTrusted() {\n return response.EmptySyncResponse\n }\n return response.Forbidden(nil)\n}\n```\n\nThe comment explicitly states that `allowAuthenticated` should be \"used in conjunction with further access control within the handler\" — which the non-recursive path fails to do.\n\n### Execution chain\n\n1. Restricted authenticated user sends `GET /1.0/certificates` (no `recursion` parameter)\n2. `allowAuthenticated` access handler passes because user is trusted (`daemon.go:263`)\n3. `certificatesGet` creates permission checker for `EntitlementCanView` on `TypeCertificate` (line 143)\n4. Loop at lines 163-176 filters `baseCerts` by permission — but only populates `certResponses` for recursive mode\n5. Since `!recursion`, control reaches lines 185-192\n6. New loop iterates ALL `baseCerts` (unfiltered) and builds URL list with fingerprints\n7. Full list of certificate fingerprints returned to restricted user\n\n## Proof of Concept\n\n```bash\n# Preconditions: restricted (non-admin) trusted client certificate\nHOST=target.example\nPORT=8443\n\n# 1) Non-recursive list: returns ALL certificate fingerprints (UNFILTERED)\ncurl -sk --cert restricted.crt --key restricted.key \\\n \"https://${HOST}:${PORT}/1.0/certificates\" | jq '.metadata | length'\n\n# 2) Recursive list: returns only authorized certificates (FILTERED)\ncurl -sk --cert restricted.crt --key restricted.key \\\n \"https://${HOST}:${PORT}/1.0/certificates?recursion=1\" | jq '.metadata | length'\n\n# Expected: (1) returns MORE fingerprints than (2), proving the authorization bypass.\n# The difference reveals fingerprints of certificates the restricted user should not see.\n```\n\n## Impact\n\n- **Identity enumeration**: A restricted user can discover the fingerprints of all trusted certificates, revealing the complete set of identities in the LXD trust store.\n- **Reconnaissance for targeted attacks**: Fingerprints identify specific certificates used for inter-cluster communication, admin access, and other privileged operations.\n- **RBAC bypass**: In deployments using fine-grained RBAC (OpenFGA or built-in TLS authorization), the non-recursive path completely bypasses the intended per-object visibility controls.\n- **Information asymmetry**: Restricted users gain knowledge of the full trust topology, which the administrator explicitly intended to hide via per-certificate `can_view` entitlements.\n\n## Recommended Remediation\n\n### Option 1: Apply the permission filter to the non-recursive path (preferred)\n\nReplace the unfiltered loop with one that checks `userHasPermission`, matching the pattern used in the recursive path and in all other list endpoints:\n\n```go\n// lxd/certificates.go — replace lines 185-192\nif !recursion {\n body := []string{}\n for _, baseCert := range baseCerts {\n if !userHasPermission(entity.CertificateURL(baseCert.Fingerprint)) {\n continue\n }\n certificateURL := api.NewURL().Path(version.APIVersion, \"certificates\", baseCert.Fingerprint).String()\n body = append(body, certificateURL)\n }\n return response.SyncResponse(true, body)\n}\n```\n\n### Option 2: Build both response types in a single filtered loop\n\nRestructure the function to build both the URL list and the recursive response in the same permission-checked loop, eliminating the possibility of divergent filtering:\n\n```go\nerr = d.State().DB.Cluster.Transaction(r.Context(), func(ctx context.Context, tx *db.ClusterTx) error {\n baseCerts, err = dbCluster.GetCertificates(ctx, tx.Tx())\n if err != nil {\n return err\n }\n\n certResponses = make([]*api.Certificate, 0, len(baseCerts))\n certURLs = make([]string, 0, len(baseCerts))\n for _, baseCert := range baseCerts {\n if !userHasPermission(entity.CertificateURL(baseCert.Fingerprint)) {\n continue\n }\n\n certURLs = append(certURLs, api.NewURL().Path(version.APIVersion, \"certificates\", baseCert.Fingerprint).String())\n\n if recursion {\n apiCert, err := baseCert.ToAPI(ctx, tx.Tx())\n if err != nil {\n return err\n }\n certResponses = append(certResponses, apiCert)\n urlToCertificate[entity.CertificateURL(apiCert.Fingerprint)] = apiCert\n }\n }\n return nil\n})\n```\n\nOption 2 is structurally safer as it prevents the two paths from diverging in the future.\n\n## Credit\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).", "title": "github - https://github.com/advisories/GHSA-crmg-9m86-636r" }, { "category": "description", "text": "## Summary\nThe `GET /1.0/certificates` endpoint (non-recursive mode) returns URLs containing fingerprints for all certificates in the trust store, bypassing the per-object `can_view` authorization check that is correctly applied in the recursive path. Any authenticated identity — including restricted, non-admin users — can enumerate all certificate fingerprints, exposing the full set of trusted identities in the LXD deployment.\n\n## Affected Component\n- `lxd/certificates.go` — `certificatesGet` (lines 185–192) — Non-recursive code path returns unfiltered certificate list.\n\n## CWE\n- **CWE-862**: Missing Authorization\n\n## Description\n\n### Core vulnerability: missing permission filter in non-recursive listing path\n\nThe `certificatesGet` handler obtains a permission checker at line 143 and correctly applies it when building the recursive response (lines 163-176). However, the non-recursive code path at lines 185-192 creates a fresh loop over the unfiltered `baseCerts` slice, completely bypassing the authorization check:\n\n```go\n// lxd/certificates.go:139-193\nfunc certificatesGet(d *Daemon, r *http.Request) response.Response {\n recursion := util.IsRecursionRequest(r)\n s := d.State()\n\n userHasPermission, err := s.Authorizer.GetPermissionChecker(r.Context(), auth.EntitlementCanView, entity.TypeCertificate)\n // ...\n\n for _, baseCert := range baseCerts {\n if !userHasPermission(entity.CertificateURL(baseCert.Fingerprint)) {\n continue // Correctly filters unauthorized certs\n }\n\n if recursion {\n // ... builds filtered certResponses ...\n }\n // NOTE: when !recursion, nothing is recorded — the filter result is discarded\n }\n\n if !recursion {\n body := []string{}\n for _, baseCert := range baseCerts { // <-- iterates UNFILTERED baseCerts\n certificateURL := api.NewURL().Path(version.APIVersion, \"certificates\", baseCert.Fingerprint).String()\n body = append(body, certificateURL)\n }\n return response.SyncResponse(true, body) // Returns ALL certificate fingerprints\n }\n\n return response.SyncResponse(true, certResponses) // Recursive path is correctly filtered\n}\n```\n\n### Inconsistency with other list endpoints confirms the bug\n\nFive other list endpoints in the same codebase correctly filter results in both recursive and non-recursive paths:\n\n| Endpoint | File | Filters non-recursive? |\n|----------|------|----------------------|\n| Instances | `lxd/instances_get.go` — `instancesGet` | Yes — filters before either path |\n| Images | `lxd/images.go` — `doImagesGet` | Yes — checks `hasPermission` for both paths |\n| Networks | `lxd/networks.go` — `networksGet` | Yes — filters outside recursion check |\n| Profiles | `lxd/profiles.go` — `profilesGet` | Yes — separate filter in non-recursive path |\n| **Certificates** | **`lxd/certificates.go` — `certificatesGet`** | **No — unfiltered** |\n\nThe certificates endpoint is the sole outlier, confirming this is an oversight rather than a design choice.\n\n### Access handler provides no defense\n\nThe endpoint uses `allowAuthenticated` as its `AccessHandler` (`certificates.go:45`), which only checks `requestor.IsTrusted()`:\n\n```go\n// lxd/daemon.go:255-267\n// allowAuthenticated is an AccessHandler which allows only authenticated requests.\n// This should be used in conjunction with further access control within the handler\n// (e.g. to filter resources the user is able to view/edit).\nfunc allowAuthenticated(_ *Daemon, r *http.Request) response.Response {\n requestor, err := request.GetRequestor(r.Context())\n // ...\n if requestor.IsTrusted() {\n return response.EmptySyncResponse\n }\n return response.Forbidden(nil)\n}\n```\n\nThe comment explicitly states that `allowAuthenticated` should be \"used in conjunction with further access control within the handler\" — which the non-recursive path fails to do.\n\n### Execution chain\n\n1. Restricted authenticated user sends `GET /1.0/certificates` (no `recursion` parameter)\n2. `allowAuthenticated` access handler passes because user is trusted (`daemon.go:263`)\n3. `certificatesGet` creates permission checker for `EntitlementCanView` on `TypeCertificate` (line 143)\n4. Loop at lines 163-176 filters `baseCerts` by permission — but only populates `certResponses` for recursive mode\n5. Since `!recursion`, control reaches lines 185-192\n6. New loop iterates ALL `baseCerts` (unfiltered) and builds URL list with fingerprints\n7. Full list of certificate fingerprints returned to restricted user\n\n## Proof of Concept\n\n```bash\n# Preconditions: restricted (non-admin) trusted client certificate\nHOST=target.example\nPORT=8443\n\n# 1) Non-recursive list: returns ALL certificate fingerprints (UNFILTERED)\ncurl -sk --cert restricted.crt --key restricted.key \\\n \"https://${HOST}:${PORT}/1.0/certificates\" | jq '.metadata | length'\n\n# 2) Recursive list: returns only authorized certificates (FILTERED)\ncurl -sk --cert restricted.crt --key restricted.key \\\n \"https://${HOST}:${PORT}/1.0/certificates?recursion=1\" | jq '.metadata | length'\n\n# Expected: (1) returns MORE fingerprints than (2), proving the authorization bypass.\n# The difference reveals fingerprints of certificates the restricted user should not see.\n```\n\n## Impact\n\n- **Identity enumeration**: A restricted user can discover the fingerprints of all trusted certificates, revealing the complete set of identities in the LXD trust store.\n- **Reconnaissance for targeted attacks**: Fingerprints identify specific certificates used for inter-cluster communication, admin access, and other privileged operations.\n- **RBAC bypass**: In deployments using fine-grained RBAC (OpenFGA or built-in TLS authorization), the non-recursive path completely bypasses the intended per-object visibility controls.\n- **Information asymmetry**: Restricted users gain knowledge of the full trust topology, which the administrator explicitly intended to hide via per-certificate `can_view` entitlements.\n\n## Recommended Remediation\n\n### Option 1: Apply the permission filter to the non-recursive path (preferred)\n\nReplace the unfiltered loop with one that checks `userHasPermission`, matching the pattern used in the recursive path and in all other list endpoints:\n\n```go\n// lxd/certificates.go — replace lines 185-192\nif !recursion {\n body := []string{}\n for _, baseCert := range baseCerts {\n if !userHasPermission(entity.CertificateURL(baseCert.Fingerprint)) {\n continue\n }\n certificateURL := api.NewURL().Path(version.APIVersion, \"certificates\", baseCert.Fingerprint).String()\n body = append(body, certificateURL)\n }\n return response.SyncResponse(true, body)\n}\n```\n\n### Option 2: Build both response types in a single filtered loop\n\nRestructure the function to build both the URL list and the recursive response in the same permission-checked loop, eliminating the possibility of divergent filtering:\n\n```go\nerr = d.State().DB.Cluster.Transaction(r.Context(), func(ctx context.Context, tx *db.ClusterTx) error {\n baseCerts, err = dbCluster.GetCertificates(ctx, tx.Tx())\n if err != nil {\n return err\n }\n\n certResponses = make([]*api.Certificate, 0, len(baseCerts))\n certURLs = make([]string, 0, len(baseCerts))\n for _, baseCert := range baseCerts {\n if !userHasPermission(entity.CertificateURL(baseCert.Fingerprint)) {\n continue\n }\n\n certURLs = append(certURLs, api.NewURL().Path(version.APIVersion, \"certificates\", baseCert.Fingerprint).String())\n\n if recursion {\n apiCert, err := baseCert.ToAPI(ctx, tx.Tx())\n if err != nil {\n return err\n }\n certResponses = append(certResponses, apiCert)\n urlToCertificate[entity.CertificateURL(apiCert.Fingerprint)] = apiCert\n }\n }\n return nil\n})\n```\n\nOption 2 is structurally safer as it prevents the two paths from diverging in the future.\n\n## Credit\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-crmg-9m86-636r.json?alt=media" }, { "category": "description", "text": "Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-3351" }, { "category": "description", "text": "Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4595.json?alt=media" }, { "category": "description", "text": "Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-3351.json?alt=media" }, { "category": "other", "text": "0.0002", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "title": "CVSSV4" }, { "category": "other", "text": "5.3", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.4", "title": "NCSC Score" }, { "category": "other", "text": "Is related to a product by vendor Canonical", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to (a version of) an uncommon product, The value of the most recent EPSS score, Exploit code publicly available, There is exploit data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5759449", "CSAFPID-5763350", "CSAFPID-5756674", "CSAFPID-3658087", "CSAFPID-3658261", "CSAFPID-3658262", "CSAFPID-3658263", "CSAFPID-3658264", "CSAFPID-3658265", "CSAFPID-3658266", "CSAFPID-3658267", "CSAFPID-3658268", "CSAFPID-3658269", "CSAFPID-3658270", "CSAFPID-3658271", "CSAFPID-3658272", "CSAFPID-3658273", "CSAFPID-3658274", "CSAFPID-3658275", "CSAFPID-3658276", "CSAFPID-3658277", "CSAFPID-3658278", "CSAFPID-3658279", "CSAFPID-3658280", "CSAFPID-3658281", "CSAFPID-3658282", "CSAFPID-3658283", "CSAFPID-3658284", "CSAFPID-3658285", "CSAFPID-3658286", "CSAFPID-3658287", "CSAFPID-3658288", "CSAFPID-3658289", "CSAFPID-3658290", "CSAFPID-3658291", "CSAFPID-3658292", "CSAFPID-3658293", "CSAFPID-3658294", "CSAFPID-3658295", "CSAFPID-3658296", "CSAFPID-3658297", "CSAFPID-3658298", "CSAFPID-3658299", "CSAFPID-3658300", "CSAFPID-3658301", "CSAFPID-3658302", "CSAFPID-3658303", "CSAFPID-3658304", "CSAFPID-3658305", "CSAFPID-3658306", "CSAFPID-3658307", "CSAFPID-3658308", "CSAFPID-3658309", "CSAFPID-3658310", "CSAFPID-3658311", "CSAFPID-3658312", "CSAFPID-3658313", "CSAFPID-3658314", "CSAFPID-3658315", "CSAFPID-3658316", "CSAFPID-3658317", "CSAFPID-3658318", "CSAFPID-3658319", "CSAFPID-3658320", "CSAFPID-3658321", "CSAFPID-3658322", "CSAFPID-3658323", "CSAFPID-3658324", "CSAFPID-3658325", "CSAFPID-3658326", "CSAFPID-3658327", "CSAFPID-3658328", "CSAFPID-3658329", "CSAFPID-3658330", "CSAFPID-3658331", "CSAFPID-3658332", "CSAFPID-3658333", "CSAFPID-3658334", "CSAFPID-3658335", "CSAFPID-3658336", "CSAFPID-3658337", "CSAFPID-3658338", "CSAFPID-3658339", "CSAFPID-3658340", "CSAFPID-3658341", "CSAFPID-3658342", "CSAFPID-3658343", "CSAFPID-3658344", "CSAFPID-3658345", "CSAFPID-3658346", "CSAFPID-3658347", "CSAFPID-3658348", "CSAFPID-3658349", "CSAFPID-3658350", "CSAFPID-3658351", "CSAFPID-3658352", "CSAFPID-3658353", "CSAFPID-3658354", "CSAFPID-3658355", "CSAFPID-3658356", "CSAFPID-3658357", "CSAFPID-3658358", "CSAFPID-3658359", "CSAFPID-3658360", "CSAFPID-3658361", "CSAFPID-3658362", "CSAFPID-3658363", "CSAFPID-3658364", "CSAFPID-3658365", "CSAFPID-3658366", "CSAFPID-3658367", "CSAFPID-3658368", "CSAFPID-3658369", "CSAFPID-3658370", "CSAFPID-3658371", "CSAFPID-3658372", "CSAFPID-3658373", "CSAFPID-3658374", "CSAFPID-3658375", "CSAFPID-3658376", "CSAFPID-3658377", "CSAFPID-3658378", "CSAFPID-3658379", "CSAFPID-3658380", "CSAFPID-3658381", "CSAFPID-3658382", "CSAFPID-3658383", "CSAFPID-3658384", "CSAFPID-3658385", "CSAFPID-3658386", "CSAFPID-3658387", "CSAFPID-3658388", "CSAFPID-3658389", "CSAFPID-3658390", "CSAFPID-3658391", "CSAFPID-3658392", "CSAFPID-3658393", "CSAFPID-3658394", "CSAFPID-3658395", "CSAFPID-3658396", "CSAFPID-3658397", "CSAFPID-3658398", "CSAFPID-3658399", "CSAFPID-3658401", "CSAFPID-3658402", "CSAFPID-3658403", "CSAFPID-3658404", "CSAFPID-3658405", "CSAFPID-3658406", "CSAFPID-3658407", "CSAFPID-5006310", "CSAFPID-5006311", "CSAFPID-5006312", "CSAFPID-5006313", "CSAFPID-5617484", "CSAFPID-5617485" ], "known_not_affected": [ "CSAFPID-1396424" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3351" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-3351" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3351" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/3xxx/CVE-2026-3351.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-3351" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-crmg-9m86-636r" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-crmg-9m86-636r" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-crmg-9m86-636r.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-3351" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4595.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-3351.json?alt=media" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/canonical/lxd/commit/d936c90d47cf0be1e9757df897f769e9887ebde1" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/canonical/lxd/pull/17738" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3351" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-crmg-9m86-636r" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-3658087", "CSAFPID-3658261", "CSAFPID-3658262", "CSAFPID-3658263", "CSAFPID-3658264", "CSAFPID-3658265", "CSAFPID-3658266", "CSAFPID-3658267", "CSAFPID-3658268", "CSAFPID-3658269", "CSAFPID-3658270", "CSAFPID-3658271", "CSAFPID-3658272", "CSAFPID-3658273", "CSAFPID-3658274", "CSAFPID-3658275", "CSAFPID-3658276", "CSAFPID-3658277", "CSAFPID-3658278", "CSAFPID-3658279", "CSAFPID-3658280", "CSAFPID-3658281", "CSAFPID-3658282", "CSAFPID-3658283", "CSAFPID-3658284", "CSAFPID-3658285", "CSAFPID-3658286", "CSAFPID-3658287", "CSAFPID-3658288", "CSAFPID-3658289", "CSAFPID-3658290", "CSAFPID-3658291", "CSAFPID-3658292", "CSAFPID-3658293", "CSAFPID-3658294", "CSAFPID-3658295", "CSAFPID-3658296", "CSAFPID-3658297", "CSAFPID-3658298", "CSAFPID-3658299", "CSAFPID-3658300", "CSAFPID-3658301", "CSAFPID-3658302", "CSAFPID-3658303", "CSAFPID-3658304", "CSAFPID-3658305", "CSAFPID-3658306", "CSAFPID-3658307", "CSAFPID-3658308", "CSAFPID-3658309", "CSAFPID-3658310", "CSAFPID-3658311", "CSAFPID-3658312", "CSAFPID-3658313", "CSAFPID-3658314", "CSAFPID-3658315", "CSAFPID-3658316", "CSAFPID-3658317", "CSAFPID-3658318", "CSAFPID-3658319", "CSAFPID-3658320", "CSAFPID-3658321", "CSAFPID-3658322", "CSAFPID-3658323", "CSAFPID-3658324", "CSAFPID-3658325", "CSAFPID-3658326", "CSAFPID-3658327", "CSAFPID-3658328", "CSAFPID-3658329", "CSAFPID-3658330", "CSAFPID-3658331", "CSAFPID-3658332", "CSAFPID-3658333", "CSAFPID-3658334", "CSAFPID-3658335", "CSAFPID-3658336", "CSAFPID-3658337", "CSAFPID-3658338", "CSAFPID-3658339", "CSAFPID-3658340", "CSAFPID-3658341", "CSAFPID-3658342", "CSAFPID-3658343", "CSAFPID-3658344", "CSAFPID-3658345", "CSAFPID-3658346", "CSAFPID-3658347", "CSAFPID-3658348", "CSAFPID-3658349", "CSAFPID-3658350", "CSAFPID-3658351", "CSAFPID-3658352", "CSAFPID-3658353", "CSAFPID-3658354", "CSAFPID-3658355", "CSAFPID-3658356", "CSAFPID-3658357", "CSAFPID-3658358", "CSAFPID-3658359", "CSAFPID-3658360", "CSAFPID-3658361", "CSAFPID-3658362", "CSAFPID-3658363", "CSAFPID-3658364", "CSAFPID-3658365", "CSAFPID-3658366", "CSAFPID-3658367", "CSAFPID-3658368", "CSAFPID-3658369", "CSAFPID-3658370", "CSAFPID-3658371", "CSAFPID-3658372", "CSAFPID-3658373", "CSAFPID-3658374", "CSAFPID-3658375", "CSAFPID-3658376", "CSAFPID-3658377", "CSAFPID-3658378", "CSAFPID-3658379", "CSAFPID-3658380", "CSAFPID-3658381", "CSAFPID-3658382", "CSAFPID-3658383", "CSAFPID-3658384", "CSAFPID-3658385", "CSAFPID-3658386", "CSAFPID-3658387", "CSAFPID-3658388", "CSAFPID-3658389", "CSAFPID-3658390", "CSAFPID-3658391", "CSAFPID-3658392", "CSAFPID-3658393", "CSAFPID-3658394", "CSAFPID-3658395", "CSAFPID-3658396", "CSAFPID-3658397", "CSAFPID-3658398", "CSAFPID-3658399", "CSAFPID-3658401", "CSAFPID-3658402", "CSAFPID-3658403", "CSAFPID-3658404", "CSAFPID-3658405", "CSAFPID-3658406", "CSAFPID-3658407", "CSAFPID-5006310", "CSAFPID-5006311", "CSAFPID-5006312", "CSAFPID-5006313", "CSAFPID-5617484", "CSAFPID-5617485", "CSAFPID-5756674", "CSAFPID-5759449", "CSAFPID-5763350" ] } ], "title": "CVE-2026-3351" } ] }