CVE-2026-34179: LXD Privilege Escalation via TLS Certificate Type Manipulation
Summary
CVE-2026-34179: LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin. Affects github.com/canonical/lxd versions >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LXD is a container management system that provides a user-friendly interface for managing Linux containers. It allows users to create, manage, and orchestrate containers with ease. The system supports various features such as networking, storage management, and security controls. However, a critical vulnerability has been identified that allows restricted TLS certificate users to escalate their privileges to cluster admin by manipulating the type field of their certificates.
Vulnerability Detail
The vulnerability arises from the improper validation of the 'Type' field in the TLS certificate update process. Specifically, restricted users can change their certificate type from 'client' to 'server' through a PUT/PATCH request to the '/1.0/certificates/{fingerprint}' endpoint. The access control mechanisms fail to check or reset the 'Type' field, allowing an attacker to gain full admin privileges. This can lead to severe consequences, including the ability to create privileged containers that provide root access to the host system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the '/1.0/certificates/{fingerprint}' endpoint to only trusted users until the patch can be applied. This can be done by modifying the access control settings in your LXD configuration.
Conclusion
CVE-2026-34179 is a critical vulnerability in LXD that allows privilege escalation through improper validation of TLS certificate types. It is essential to update to the patched versions of LXD to mitigate this risk and ensure the security of your container management system.
See every vulnerability recorded for github.com/canonical/lxd →
FAQ
CVE-2026-34179 is a critical vulnerability in LXD that allows restricted TLS certificate users to escalate their privileges to cluster admin by manipulating the certificate type.
If your LXD deployment uses legacy restricted TLS certificates, this vulnerability could allow unauthorized users to gain full admin access, potentially compromising your entire host system.
The primary symptom is the ability of restricted users to perform actions that should only be available to cluster admins, such as creating privileged containers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/canonical/lxd.
