CVE-2026-3351

Go/github.com/canonical/lxd CVE-2026-3351: medium, EPSS 0.22%

lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints

Action: Upgrade github.com/canonical/lxd to 0.0.0-20260224152359-d936c90d47cf or later.

go get github.com/canonical/lxd@v0.0.0-20260224152359-d936c90d47cf

Affected

Fixed versions

Sources

• osv: GHSA-crmg-9m86-636r
• https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r
• https://nvd.nist.gov/vuln/detail/CVE-2026-3351
• https://github.com/canonical/lxd/pull/17738
• https://github.com/canonical/lxd/commit/d936c90d47cf0be1e9757df897f769e9887ebde1
• https://github.com/canonical/lxd

CVE-2026-3351 · published 2026-03-04T20:18:56Z · modified 2026-03-23T04:56:22.113832544Z · JSON

Go/github.com/canonical/lxd CVE-2026-3351: unknown, EPSS 0.22%

Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-4595
• https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r
• https://github.com/canonical/lxd/commit/d936c90d47cf0be1e9757df897f769e9887ebde1
• https://github.com/canonical/lxd/pull/17738

CVE-2026-3351 · published 2026-03-10T18:28:25Z · modified 2026-03-23T04:53:13.085962Z · JSON