CVE-2026-28384 Authenticated RCE via unsanitized compression_algorithm

What is CVE-2026-28384?

CVE-2026-28384 is a critical command injection vulnerability in Canonical lxd, published on 12 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

Weakness: CWE-78

Which versions are affected by CVE-2026-28384?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-28384?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-28384 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28384 exists.

Other vulnerabilities in Canonical lxd

• CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root Critical 9.9
• CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag Critical 9.9
• CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root Critical 9.9
• CVE-2026-63294 Root RCE via image backup.yaml symlink Critical 9.9
• CVE-2026-63296 Project restriction bypass via instance migration config override Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-28384, GHSA-4rmf-rcp8-2r9g.