CVE-2024-6219 lxd has a restricted TLS certificate privilege escalation when in PKI mode

What is CVE-2024-6219?

CVE-2024-6219 is a low-severity authentication bypass vulnerability in Canonical Ltd. LXD, published on 5 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.

Weakness: CWE-295

Which versions are affected by CVE-2024-6219?

3 open source packages ship an affected version, including github.com/canonical/lxd. It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2024-6219?

Upgrade github.com/canonical/lxd to 0.0.0-20240403103450-0e7f2b5bf4d2 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-6219 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6219 exists.

Other vulnerabilities in Canonical Ltd. LXD

• CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root Critical 9.9
• CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag Critical 9.9
• CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root Critical 9.9
• CVE-2026-63294 Root RCE via image backup.yaml symlink Critical 9.9
• CVE-2026-63296 Project restriction bypass via instance migration config override Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jpmc-7p9c-4rxf, GO-2024-3313, UBUNTU-CVE-2024-6219.