Go/github.com/canonical/lxd CVE-2026-3351: medium 4.3, EPSS 0.15%

lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints

Action: Upgrade github.com/canonical/lxd to 0.0.0-20260224152359-d936c90d47cf or later.

go get github.com/canonical/lxd@v0.0.0-20260224152359-d936c90d47cf

Affected

Fixed versions

Sources

• osv: GHSA-crmg-9m86-636r
• nvd: CVE-2026-3351
• https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r
• https://github.com/canonical/lxd/pull/17738
• https://github.com/canonical/lxd/commit/d936c90d47cf0be1e9757df897f769e9887ebde1
• https://github.com/canonical/lxd

CVE-2026-3351 · published 2026-03-04T20:18:56Z · modified 2026-03-23T04:56:22.113832544Z · JSON