CVE-2026-34179 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-34179 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-34179 is an improper input validation vulnerability in Canonical LXD, affecting the certificate management API endpoint in versions 4.12 through 6.7, where the server fails to validate the Type field in certificate update requests.

Technical Detail

The flaw exists in the doCertificateUpdate function within lxd/certificates.go, which processes PUT and PATCH requests to the /1.0/certificates/{fingerprint} API endpoint without enforcing validation on the Type field supplied by the requester. An attacker with access to the LXD API, such as a user holding a restricted trust certificate, could submit a crafted request that modifies the certificate Type to an elevated trust level, effectively achieving privilege escalation within the LXD environment. Successful exploitation could allow an attacker to gain unrestricted administrative control over the LXD daemon, including the ability to manage containers, access host resources, and potentially escape container boundaries depending on configuration.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning no public proof-of-concept or operational tooling has been confirmed as of April 16, 2026. This status should be monitored closely given the severity of the vulnerability and the straightforward nature of the attack vector.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Organizations operating LXD in multi-tenant or cloud infrastructure environments should treat this as a priority given the potential for lateral movement and privilege escalation in those contexts.

What To Do

Organizations running Canonical LXD versions 4.12 through 6.7 should apply the vendor-supplied patch as soon as it becomes available and treat this as a high-priority remediation given the CVSS score of 9.1. As an interim measure, restrict API access to the LXD daemon to only fully trusted administrative identities and audit existing certificate trust levels to identify any certificates with unexpected Type assignments. Network-level controls should be reviewed to ensure the LXD API socket is not exposed to untrusted users or network segments. Monitor LXD API logs for anomalous PUT or PATCH requests targeting the /1.0/certificates/ endpoint as a detection signal pending patch deployment.