Threats tagged 'ghsa-p8hw-rfjg-689h'

CVE-2025-54286 is a Cross-Site Request Forgery (CSRF) vulnerability in Canonical's LXD when using client certificate authentication with the LXD-UI. The vulnerability arises because client certificates bypass the SameSite cookie protections, and the LXD API accepts JSON payloads even when the Content-Type header is set to text/plain or application/x-www-form-urlencoded, allowing CSRF attacks via HTML form submissions. An attacker can exploit this by tricking an authenticated user into visiting a malicious website that automatically creates and starts arbitrary container instances. The vulnerability requires the victim to be authenticated with client certificates and have permissions to create instances. Fixes are available in LXD versions 5.0.5, 5.21.4, and 6.5.