CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users

Medium 5.0 Published 26 Jun 2026 Updated 26 Jun 2026

Authenticated users can exploit SSRF in LXD image imports to probe internal networks and access restricted services via the daemon.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-28385?

CVE-2026-28385 is a medium-severity server-side request forgery vulnerability in Canonical lxd, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

Weakness: CWE-918

Which versions are affected by CVE-2026-28385?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-28385?

No fix has been published for CVE-2026-28385 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-28385 being exploited?

There is no known exploitation of CVE-2026-28385 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-28385, GHSA-3gq2-x4qg-p4g6.