Skip to content
Fencer Vulns
critical 9.1

CVE-2026-34179 json

Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

published 2026-04-09 7 mo ago modified 2026-10-26 13 d ago also GHSA-c3h3-89qf-jqm5 , GO-2026-5306 , EUVD-2026-20876

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

Patch / fix

  • Canonical lxd 5.0.7, 5.21.5, 6.8.0
  • lxd Debian 13 5.0.2+git20231211.1364ae4-9+deb13u5
  • incus Debian 13 6.0.4-2+deb13u6
  • incus Debian 14 6.0.6-3

debian advisories DEBIAN-CVE-2026-34179

  • govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1

suse advisories SUSE-SU-2026:23625-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1

opensuse advisories openSUSE-SU-2026:21761-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/canonical/lxd
>=0.0.0-20210305023314-538ac3df036e, <=0.0.0-20260226085519-736f34afb267
all versions
 no fix listed

Affected products

  • Canonical lxd

Classification

Weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.