CVE-2026-28385CWE-918

SSRF via image import from URL allows internal network probing by authenticated users

Medium · published June 26, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-26T16:23Z
EPSS history
Timeline
  • 26 JUN 16:23Z
    SSRF via image import from URL allows internal network probing by authenticated users
    cvelistv5