{"id":"EUVD-2026-20876","revision":"47ad6f44b18c4ec199607f58e9026a30","records":[{"revision":"47ad6f44b18c4ec199607f58e9026a30","observedAt":"2026-10-30T05:49:48.945+00:00","statement":{"source":"euvd","id":"EUVD-2026-20876","aliases":["CVE-2026-34179","GHSA-c3h3-89qf-jqm5"],"title":"In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, a…","description":"In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":9.1,"severity":null}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-c3h3-89qf-jqm5","https://github.com/canonical/lxd/pull/17936"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20876","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 9, 2026, 9:22:14 AM","dateUpdated":"Apr 9, 2026, 11:54:18 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-20876","identifiers":["EUVD-2026-20876","CVE-2026-34179","GHSA-c3h3-89qf-jqm5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}