CVE-2025-54288

MEDIUM

Canonical LXD 4.0-5.21.4 - Authenticated Information Spoofing via Process Name

Title source: llm

Description

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

References (1)

Core 1

Core References

Exploit, Vendor Advisory

https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525

Scores

CVSS v3 6.8

EPSS 0.0032

EPSS Percentile 23.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-290

Status published

Products (2)

canonical/lxd 4.0 - 5.21.4Go

canonical/lxd 4.0.0 - 5.21.4

Published Oct 02, 2025

Tracked Since Feb 18, 2026