CVE-2026-28384: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-28384 is an OS command injection vulnerability in Canonical LXD that allows an authenticated, unprivileged user to execute arbitrary commands as the LXD daemon (typically root) on the host server. It affects LXD versions 4.12 through 6.6 across the snap channels 5.0/stable, 5.21/stable, and 6.0/stable; the 4.0/stable channel (version 4.0.10) is not affected because the restricted project feature is absent. The vulnerability was discovered by bugbunny.ai and publicly disclosed on March 12, 2026. It carries a CVSS v4.0 base score of 9.4 (Critical) and a CVSS v3.1 score of 9.9 (Critical) (GitHub Advisory, Ubuntu Discourse).

The root cause is CWE-78 (OS Command Injection): the compressFile function in lxd/images.go accepts a user-controlled compression_algorithm string, parses it using shell-quoting rules via shellquote.Split(), and passes the first token directly to exec.Command() as the executable, always prepending -c as the first argument. This means a payload such as bash "sleep 5; cat" is executed as exec.Command("bash", "-c", "sleep 5; cat") — arbitrary shell command execution as root. The flaw exists in three independent API handlers: image creation (POST /1.0/images), instance backup creation (POST /1.0/instances/{name}/backups), and storage volume backup creation (POST /1.0/storage-pools/{pool}/volumes/{type}/{name}/backups). Critically, while compression_algorithm is validated via IsCompressionAlgorithm when set through server or project configuration, this validation was entirely absent for the per-request CompressionAlgorithm field in all three handlers; furthermore, the original validator only checked exec.LookPath(), which would have permitted system binaries like bash or python3 to pass (GitHub Advisory, Fix Commit).

Successful exploitation grants an attacker host-level root code execution in the context of the LXD daemon, enabling full compromise of the host filesystem, network, and all managed containers and VMs. In multi-tenant LXD environments, a low-privileged tenant can access all other tenants' data and instances. In clustered LXD deployments, compromise of one cluster member's daemon can be leveraged for lateral movement to other cluster members. The vulnerability affects confidentiality, integrity, and availability at both the vulnerable component and system scope (GitHub Advisory, Ubuntu Discourse).

As of the disclosure date, no public proof-of-concept exploit code has been observed and there is no evidence of in-the-wild exploitation (Feedly). The vulnerability requires valid LXD credentials with can_create_images (project-level) or can_manage_backups (instance/volume-level) entitlements — permissions routinely granted to regular users. Exploitation requires only a single crafted API request with no user interaction, making it highly automatable once credentials are obtained. The EPSS score is approximately 0.116%, and the vulnerability is not currently listed in the CISA KEV catalog. A time-based PoC (using bash "sleep 5; cat") is included in the official advisory to demonstrate the issue non-destructively (GitHub Advisory).

1. Obtain valid LXD credentials: Acquire authentication credentials for an LXD account with at minimum can_create_images or can_manage_backups entitlements on the target project or instance — these are commonly granted to regular users.
2. Identify the target: Locate a network-accessible LXD server running a vulnerable version (4.12–6.6) by checking the snap channel and revision via snap list | grep lxd or by querying the LXD API endpoint.
3. Craft the malicious API request: Prepare a JSON payload targeting one of the three vulnerable endpoints with a malicious compression_algorithm value. For example, to achieve command execution via the image endpoint:

   curl --unix-socket /var/lib/lxd/unix.socket \
     -H 'Content-Type: application/json' \
     -X POST 'http://localhost/1.0/images?project=default' \
     -d '{"source":{"type":"instance","name":"c1"},"compression_algorithm":"bash \"id > /tmp/pwned; cat\""}'

4. Trigger execution: The LXD daemon parses the compression_algorithm field, splits it via shellquote.Split(), and calls exec.Command("bash", "-c", "id > /tmp/pwned; cat") — executing the injected command as root on the host.
5. Achieve objective: The injected command runs with LXD daemon privileges (typically root), enabling reverse shell establishment, credential harvesting, data exfiltration, container escape, or lateral movement to other cluster members (GitHub Advisory, Ubuntu Discourse).

• Network: Unexpected outbound connections from the LXD host process to external IPs following API calls to /1.0/images, /1.0/instances/{name}/backups, or /1.0/storage-pools/{pool}/volumes/{type}/{name}/backups.
• Logs: LXD API access logs showing POST requests to image or backup endpoints with unusual compression_algorithm values (e.g., containing bash, python3, perl, sh, or shell metacharacters); LXD daemon logs showing unexpected process execution errors or unusual command output.
• Process: Unusual child processes spawned by the LXD daemon process (e.g., /bin/bash, python3, curl, wget, nc) that are not standard compression utilities (gzip, bzip2, xz, zstd, etc.).
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the LXD daemon; new cron jobs, SSH authorized keys, or scripts added by the LXD service account; web shells or backdoors placed on the host filesystem.

Canonical released fixes on March 11–12, 2026 in the following snap versions: 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0/stable). Users on channel 4.0/stable (version 4.0.10) are not affected and require no action. The recommended remediation is to upgrade immediately using sudo snap refresh lxd. As a workaround prior to patching, restrict LXD API access to only fully trusted users and revoke can_create_images and can_manage_backups entitlements from any non-administrative accounts. The fix implements an allowlist of valid compression commands (bzip2, gzip, lzma, pigz, pzstd, squashfs, xz, zstd) enforced both at the API handler level and inside compressFile itself (Ubuntu Discourse, Fix Commit).

Canonical published an official advisory on the Ubuntu Community Hub on March 12, 2026, crediting bugbunny.ai for the discovery and providing detailed remediation steps (Ubuntu Discourse). The GitHub Security Advisory (GHSA-4rmf-rcp8-2r9g) includes a detailed technical breakdown and a non-destructive time-based PoC, indicating a high level of transparency from the maintainers (GitHub Advisory). Vulnerability tracking services including Tenable Nessus (plugins 304243 and 304555), Qualys, and INCIBE-CERT picked up the advisory shortly after disclosure, reflecting broad industry attention to the issue.