{"id":"EUVD-2026-39805","revision":"ff158b6711a2447382e4fa17b807caf2","records":[{"revision":"ff158b6711a2447382e4fa17b807caf2","observedAt":"2026-11-06T19:05:39.952+00:00","statement":{"source":"euvd","id":"EUVD-2026-39805","aliases":["CVE-2026-28385","GHSA-3gq2-x4qg-p4g6"],"title":"LXD: SSRF via image import from URL allows internal network probing by authenticated users","description":"LXD: SSRF via image import from URL allows internal network probing by authenticated users","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","score":5,"severity":null}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-3gq2-x4qg-p4g6","https://github.com/canonical/lxd/pull/18462","https://nvd.nist.gov/vuln/detail/CVE-2026-28385","https://github.com/canonical/lxd/pull/18210","https://github.com/canonical/lxd/commit/08996fa031eebc2bc2f8e27148c2ba24386c01d0","https://github.com/canonical/lxd/commit/4bbdb17ab67010446668e4b00a5175df5b6d55b4","https://github.com/canonical/lxd/commit/5976c92117b79d73437d7fab55e34cb80083edff","https://github.com/canonical/lxd/commit/886fcf5b7686bf59de78e239cec90a69e8fb9c65","https://github.com/canonical/lxd/commit/c4a919f3f4e21249d535d4030a33484313026111","https://github.com/canonical/lxd/blob/lxd-6.10.0/lxd/image_source_transitional.go","https://github.com/canonical/lxd/blob/lxd-6.9/lxd/daemon_images.go","https://github.com/canonical/lxd/blob/lxd-6.9/lxd/images.go","https://github.com/canonical/lxd/releases/tag/lxd-6.9"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39805","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 6, 2026, 6:29:18 PM","dateUpdated":"Nov 6, 2026, 6:29:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39805","identifiers":["EUVD-2026-39805","CVE-2026-28385","GHSA-3gq2-x4qg-p4g6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}