CVE-2025-54289

Go/github.com/canonical/lxd CVE-2025-54289: medium 6.8, EPSS 0.21%

Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API

Action: Upgrade github.com/canonical/lxd to 0.0.0-20250827065555-0494f5d47e41 or later.

go get github.com/canonical/lxd@v5.21.4

go get github.com/canonical/lxd@v6.5

go get github.com/canonical/lxd@v0.0.0-20250827065555-0494f5d47e41

Affected

Fixed versions

Sources

• osv: GHSA-3g72-chj4-2228
• https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228
• https://nvd.nist.gov/vuln/detail/CVE-2025-54289
• https://github.com/canonical/lxd
• https://pkg.go.dev/vuln/GO-2025-3999

CVE-2025-54289 · published 2025-10-02T21:19:29Z · modified 2026-09-10T03:50:29.167406544Z · JSON

Go/github.com/canonical/lxd CVE-2025-54289: unknown, EPSS 0.21%

Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2025-3999
• https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228

CVE-2025-54289 · published 2025-11-05T18:41:07Z · modified 2025-11-05T19:57:41.140048Z · JSON