VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/canonical/lxd: vulnerability history, versions and safety

github.com/canonical/lxd is a package in the Go ecosystem. Vulert records 26 vulnerabilities for it across 120 releases, from Dec 2023 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
26 vulnerabilities recorded C3 H3 M4 L3 U13
i
10 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
15 in the last 12 months

Most recent disclosure 11 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/canonical/lxd vulnerabilities

Vulert verdict on github.com/canonical/lxd v0.0.0-20261023100733-d36c41cfe3d1 i

Updated on 23 Oct 2026

Careful: v0.0.0-20261023100733-d36c41cfe3d1 has 10 known vulnerabilities, and 5 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.0.0-20261023100733-d36c41cfe3d1 — affected i
  • Vulnerabilities on record 26 over 2 years · 15 in the last year i
  • Latest disclosure 11 Aug 2026 i
  • Highest CVSS 9.1 i
  • With no published fix 10 i
  • Stars 4,838 i
  • Last release this month i
  • Licence AGPL-3.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/canonical/lxd, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261023100733-d36c41cfe3d1 23 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261023094416-b906bd7ef203 23 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261023090101-cf2abcba86de 23 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261023084400-3f507b7087a7 23 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261023074956-08b9df8a770f 23 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261022203323-c9b07e63803a 22 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261022195543-e7c26fc8e2df 22 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261022194314-8eb764647e4c 22 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261022172321-dd38e55ae20d 22 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261022164356-9eae420209d1 22 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261022080141-2d6f47bafc5d 22 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261021150956-519a5617563b 21 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261021101540-2fba56e1dbb7 21 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020214530-462f4b70931c 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020212415-dde13219c174 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020164203-bfb21e22b6b7 20 Oct 2026 M1 L2 U7 Apache-2.0 No Details →
v0.0.0-20261020162514-09023a254748 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020145630-3a2285c302ba 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020142835-c8d5de081157 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020132139-bf1180b756a7 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261020105136-d1c9356f0551 20 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019222259-1a5f7ffe081f 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019213846-f7002c3974aa 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019211349-d312c369364f 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019205830-9780276b1fe3 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019205637-6ad5a8c8dc62 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019205235-cb298af5aae1 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019204703-8aab935aa7dc 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019185501-aea0e83cf74a 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019183508-355a512945e9 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019181345-05dc6dcaf8e9 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019165743-7ca6d1fcece9 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019161019-5071afe85a9e 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019153121-59794ef27fcf 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019152823-61caafdb1810 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019134956-7e89c33d754f 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261019072121-3225d12109f4 19 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261016183745-e0b7e600e0c7 16 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261016151816-5aac3d46b39c 16 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261016145039-a02b4adb6295 16 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261016134443-8c7bad3d59b9 16 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261016124909-725185f52765 16 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261016083655-2318d78288bf 16 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261015192313-6cdbf135dacc 15 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261015173447-c163addbb07c 15 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261015145643-2772a9458895 15 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014215752-4bb280714a65 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014182511-9828e5baa059 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014175411-e21cd904faa3 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014162213-24f1a0007b10 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014133223-47984d10b338 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014124930-37c5288c160a 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261014011844-4faf9482d7dd 14 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013173405-c5e6f55d4d78 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013171616-922744383e88 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013171527-e3f8bc37a659 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013163744-13c3c344a1e6 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013153720-39d2697ca6f5 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013151932-4c8797051319 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013141624-8f2f8761a846 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013135847-114491165a7c 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013121231-ba1b9bc5742d 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013120929-21335d5e0f0c 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013111636-c4587e883cd8 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261013073748-6b553e4f7892 13 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261012155019-21aa8b191d13 12 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261012123619-3c94d4fae7ff 12 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261012083040-c1cd259074fd 12 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261012075730-43fa946d0603 12 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261011071908-ab7685ad5027 11 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261009201946-d2f5e0ca1f9e 09 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261009133542-8e123548011e 09 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261009130701-f1e99ce433c1 09 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261009122748-86ae3a9dcf82 09 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261009113725-591fd1589869 09 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261008164752-516fb4509307 08 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261007170933-317193823ff1 07 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261007152220-dd4cf82bc08d 07 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261007080223-44384ab5c1c2 07 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006152845-a59646c448b7 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006151047-1a21678a2baf 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006151016-e05a1535485e 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006145009-d80360fc0a9a 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006141759-bac1352fb013 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006094727-26e5294e7f31 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006092728-46318d9dc6b5 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261006075421-99e0bf764954 06 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005171426-710ce4a3f31e 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005165125-26a9ed090e81 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005161525-5f575c18ceae 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005155553-4ab42a5c4aa0 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005153228-5a47288200d0 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005150958-0ef7822855cc 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005144318-448927ce0fd8 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005140422-7e1b61137196 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005133302-c4a919f3f4e2 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005130757-cca3e3e52b44 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005130103-0af9532ff467 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005100710-72af555ec813 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261005071404-5800bd7da818 05 Oct 2026 M1 L2 U7 AGPL-3.0 No Details →
v0.0.0-20261002215516-8a978bf27a14 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261002192306-c644228a3d43 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261002180022-471ca1edc058 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261002145829-fcd4c6813eba 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261002131202-21160a7bd526 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261002082415-28b4df52065d 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261002071624-f98b5d792f87 02 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261001214926-0550a9227e59 01 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261001184437-6adaa72927de 01 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261001175620-81c95fcc1cf5 01 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261001153143-f32f851acbfc 01 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261001145307-298310be30a6 01 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20261001122911-de9c248f6fbd 01 Oct 2026 M1 L2 U7 — No Details →
v0.0.0-20260930162626-d79bd9296b10 30 Sep 2026 M1 L2 U7 — No Details →
v0.0.0-20260930155859-ef064071cbcd 30 Sep 2026 M1 L2 U7 — No Details →
v0.0.0-20260930083512-ad3e922f8bf1 30 Sep 2026 M1 L2 U7 — No Details →
v0.0.0-20260929224733-02ae75e5dff4 29 Sep 2026 M1 L2 U7 — No Details →
v0.0.0-20260929164644-b12b4f6703d6 29 Sep 2026 M1 L2 U7 — No Details →
v0.0.0-20260929145015-83ce965ecfa3 29 Sep 2026 M1 L2 U7 — No Details →
v0.0.0-20260929084414-0b49528f775c 29 Sep 2026 M1 L2 U7 — No Details →

The newest 120 of 4,120 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 1
  • 2024 4
  • 2025 13
  • 2026 8

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 15 of the 26 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/canonical/lxd

The 5 most severe of 26 vulnerabilities recorded for this package

Search all 26 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-34179: LXD Privilege Escalation via TLS Certificate Type Manipulation 9.1 critical No fix published 10 Apr 2026
CVE-2026-34178: LXD Instance Backup Import Vulnerability Leading to Project Restriction Bypass 9.1 critical No fix published 10 Apr 2026
CVE-2026-34177: LXD VM Low-Level Restriction Bypass via raw.apparmor and raw.qemu.conf 9.1 critical No fix published 10 Apr 2026
CVE-2025-54286: Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI 8.3 high 5.0.5 02 Oct 2025
CVE-2025-54290: Canonical LXD Project Existence Determination Through Error Handling in Image Export Function 6.9 medium 5.21.4 02 Oct 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/canonical/lxd

Is github.com/canonical/lxd safe to use?

Vulert records 26 vulnerabilities for github.com/canonical/lxd in Go: 3 critical, 3 high, 4 medium and 3 low, plus 13 not yet rated. 10 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/canonical/lxd's Vulert package health score?

Vulert scores github.com/canonical/lxd 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/canonical/lxd affected?

Yes. v0.0.0-20261023100733-d36c41cfe3d1, the version you would install today, has 10 known vulnerabilities, and 5 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/canonical/lxd have?

26 vulnerabilities are recorded for github.com/canonical/lxd in the Go ecosystem: 3 critical, 3 high, 4 medium and 3 low, plus 13 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/canonical/lxd vulnerabilities disclosed?

15 vulnerabilities were recorded for github.com/canonical/lxd in the last 12 months, and the oldest entry in this database dates to 05 Dec 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/canonical/lxd are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/canonical/lxd for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/canonical/lxd version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.