CVE-2026-34179
Canonical Lxd 4.12 – 5.0.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-34179 is a critical-severity Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) vulnerability in Canonical Lxd. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34179 is a privilege escalation vulnerability in Canonical LXD versions 4.12 through 6.7. The issue resides in the doCertificateUpdate function within lxd/certificates.go, which does not validate the Type field during PUT/PATCH requests to the /1.0/certificates/{fingerprint} endpoint for users authenticated via restricted TLS certificates. This improper validation, tied to CWE-915, enables attackers to manipulate certificate attributes inappropriately.
A remote authenticated attacker possessing restricted TLS certificate privileges can exploit this vulnerability with low complexity over the network. By sending a crafted PUT/PATCH request, they can escalate their access to cluster administrator level, achieving high confidentiality, integrity, and availability impacts across the changed scope, as indicated by the CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Canonical has addressed the issue via a patch in https://github.com/canonical/lxd/pull/17936. Additional details on the vulnerability and remediation are provided in the GitHub Security Advisory at https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5. Security practitioners should apply the patch and review access controls for TLS certificate users in LXD clusters.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20876
Vulnerability Data
In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorizations so that only permitted attributes may be modified on an object.
Limits the set of modifiable attributes a subject is authorized to touch.
Validates incoming attribute names and values so that only explicitly allowed fields are accepted for update.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require allow-listing of mutable object attributes and input validation to block mass-assignment flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly forbid unsafe dynamic attribute assignment and require property allow-lists.
Security testing can detect mass-assignment flaws but does not itself prevent them at runtime.
Secure development lifecycle requires input validation and object-property whitelisting that directly mitigates mass-assignment risks.
Application security requirements include explicit rules for allowable object attributes and safe deserialization.
Secure architecture principles mandate strict control over dynamic object modification and attribute binding.
Information access restriction limits who can modify objects but does not address which attributes may be changed.