{"id":"EUVD-2026-20876","enisaUuid":"a1af2987-5ec6-36b7-b800-aea65b643e66","description":"In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.","datePublished":"Apr 9, 2026, 9:22:14 AM","dateUpdated":"Apr 9, 2026, 11:54:18 AM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5\nhttps://github.com/canonical/lxd/pull/17936\n","aliases":"CVE-2026-34179\nGHSA-c3h3-89qf-jqm5\n","assigner":"canonical","epss":0.27,"enisaIdProduct":[{"id":"5d8db309-959c-35d9-8c13-2646d6572aed","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"5.1.0 \u003c5.21.5"},{"id":"6d141225-1449-3cfb-b706-aca0e2bc6099","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"6.0.0 \u003c6.8.0"},{"id":"dd55a38b-1e1e-306f-9ff3-ab2ec508981d","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"4.12.0 \u003c5.0.7"}],"enisaIdVendor":[{"id":"7d74e65b-940f-360d-bc1d-4de78333b879","vendor":{"name":"Canonical"}}],"enisaIdVulnerability":[{"id":"7f97b54d-fd5e-3c8d-a392-cac332c3c895","vulnerability":{"id":"CVE-2026-34179","description":"In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.","datePublished":"Apr 9, 2026, 9:22:14 AM","dateUpdated":"Apr 9, 2026, 11:54:18 AM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5\nhttps://github.com/canonical/lxd/pull/17936\n","enisa_id":"EUVD-2026-20876\n","assigner":"canonical","epss":0.27,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"40948adf-e78a-36b0-9bf0-179525e556b0","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"4.12.0 \u003c5.0.7"},{"id":"a221cd2a-d8c6-3543-b335-5daedd5823e1","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"5.1.0 \u003c5.21.5"},{"id":"d3c12263-e506-3799-9194-8f91f0b7cba7","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"6.0.0 \u003c6.8.0"}],"vulnerabilityVendor":[{"id":"ecf4de4a-db93-377b-8b25-9579b43fd3ce","vendor":{"name":"Canonical"}}]}},{"id":"df0898fc-c233-3d09-9a65-4c50710c8235","vulnerability":{"id":"GHSA-c3h3-89qf-jqm5","description":"LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin","datePublished":"Apr 10, 2026, 7:20:50 PM","dateUpdated":"Apr 10, 2026, 7:20:50 PM","baseScore":0.0,"references":"https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34179\nhttps://github.com/canonical/lxd/pull/17936\nhttps://github.com/canonical/lxd\n","enisa_id":"EUVD-2026-20876\n","aliases":"CVE-2026-34179\nGHSA-c3h3-89qf-jqm5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}