CVE-2025-54286

Go/github.com/canonical/lxd CVE-2025-54286: high 8.3, EPSS 0.13%

Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

Action: Upgrade github.com/canonical/lxd to 0.0.0-20250827065555-0494f5d47e41 or later.

go get github.com/canonical/lxd@v5.0.5

go get github.com/canonical/lxd@v5.21.4

go get github.com/canonical/lxd@v6.5

go get github.com/canonical/lxd@v0.0.0-20250827065555-0494f5d47e41

Affected

Fixed versions

Sources

• osv: GHSA-p8hw-rfjg-689h
• https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h
• https://nvd.nist.gov/vuln/detail/CVE-2025-54286
• https://github.com/canonical/lxd
• https://pkg.go.dev/vuln/GO-2025-4003

CVE-2025-54286 · published 2025-10-02T21:23:44Z · modified 2026-09-10T03:50:29.980184458Z · JSON

Go/github.com/canonical/lxd CVE-2025-54286: unknown, EPSS 0.13%

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2025-4003
• https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h

CVE-2025-54286 · published 2025-11-05T18:41:07Z · modified 2025-11-05T19:57:41.632442Z · JSON