Threats tagged 'ghsa-3gq2-x4qg-p4g6'

CVE-2026-28385 is a server-side request forgery (SSRF) vulnerability in the LXD image import-from-URL endpoint. Authenticated users with the can_create_images entitlement can cause the LXD daemon to make HTTP requests to arbitrary internal network addresses, including private IP ranges and loopback addresses, without any filtering or blocking. This enables internal network probing and port scanning from the daemon's privileged network position. The vulnerability also involves a chained SSRF via attacker-controlled response headers. The vulnerability has a medium severity with low confidentiality impact and no integrity or availability impact.