CVE-2026-28385

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

LXD: SSRF via image import from URL allows internal network probing by authenticated users

Summary

The LXD image import-from-URL endpoint (POST /1.0/images with source.type=url) makes server-side HTTP requests to an attacker-supplied URL without any private-IP or loopback blocking. An authenticated user with the can_create_images entitlement can force the LXD daemon to connect to internal network addresses (127.0.0.1, RFC1918 ranges, cloud metadata endpoints), enabling port scanning via error-based inference and interaction with internal HTTP services from the daemon's privileged network position.

Severity

• Attack Vector: Network — LXD API is network-accessible.
• Attack Complexity: Low — Single crafted API request with no special conditions.
• Privileges Required: Low — Requires can_create_images entitlement, a non-admin permission commonly delegated to regular users.
• User Interaction: None.
• Scope: Changed — The attacker leverages LXD's privileged network position to probe and interact with internal services that are outside the attacker's direct network access and outside the scope of LXD's image management authorization.
• Confidentiality Impact: Low — Error messages reveal internal port states (open/closed/filtered) and service availability. Response bodies from internal services are NOT returned to the attacker (hash validation blocks content exfiltration).
• Integrity Impact: None — No demonstrated ability to modify data on internal services.
• Availability Impact: None — No meaningful resource exhaustion or denial of service.

Affected Component

• lxd/images.go — imgPostURLInfo (lines 668–755) — Makes HEAD request to user-supplied URL without any SSRF protections.
• lxd/util/http.go — HTTPClient (lines 102–147) — Creates HTTP client with no IP blocking or URL validation.
• shared/network.go — RFC3493Dialer (lines 20–49) — Dials arbitrary hosts including private/loopback ranges.
• lxd/daemon_images.go — ImageDownload (lines 478–510, "direct" case) — Makes GET request to URL from attacker-controlled response header.

Description

Core vulnerability: no SSRF protections on server-side image fetching

When a user imports an image from a URL, the imgPostURLInfo function makes an HTTP HEAD request directly to the user-supplied URL with zero validation:

// lxd/images.go:668-703
func imgPostURLInfo(ctx context.Context, s *state.State, req api.ImagesPost, ...) (*api.Image, error) {
    if req.Source.URL == "" {
        return nil, errors.New("Missing URL")
    }

    myhttp, err := util.HTTPClient("", s.Proxy)
    // ...

    // Resolve the image URL
    head, err := http.NewRequest("HEAD", req.Source.URL, nil)
    // No URL validation, no scheme check, no IP range check
    // ...

    raw, err := myhttp.Do(head)  // Makes request to arbitrary destination

The HTTP client is created via util.HTTPClient which uses shared.RFC3493Dialer — a standard dialer with zero private-IP filtering:

// shared/network.go:20-49
func RFC3493Dialer(context context.Context, network string, address string) (net.Conn, error) {
    host, port, err := net.SplitHostPort(address)
    // ...
    addrs, err := net.LookupHost(host)
    // ...
    for _, a := range addrs {
        c, err := net.DialTimeout(network, net.JoinHostPort(a, port), 10*time.Second)
        // No check: IsLoopback? IsPrivate? IsLinkLocalUnicast?
        // Connects to ANY resolved address including 127.0.0.1, 10.x.x.x, 169.254.169.254

The HTTP client also follows redirects unconditionally:

// lxd/util/http.go:139-144
myhttp.CheckRedirect = func(req *http.Request, via []*http.Request) error {
    // Replicate the headers
    req.Header = via[len(via)-1].Header
    return nil  // Always follows redirects — no destination validation
}

No SSRF protections exist anywhere in the codebase

An exhaustive search for private-IP checks (IsLoopback, IsPrivate, IsLinkLocalUnicast), URL allowlists, or SSRF-specific…

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

Summary

The LXD image import-from-URL endpoint (POST /1.0/images with source.type=url) makes server-side HTTP requests to an attacker-supplied URL without any private-IP or loopback blocking. An authenticated user with the can_create_images entitlement can force the LXD daemon to connect to internal network addresses (127.0.0.1, RFC1918 ranges, cloud metadata endpoints), enabling port scanning via error-based inference and interaction with internal HTTP services from the daemon's privileged network position.

Severity

• Attack Vector: Network — LXD API is network-accessible.
• Attack Complexity: Low — Single crafted API request with no special conditions.
• Privileges Required: Low — Requires can_create_images entitlement, a non-admin permission commonly delegated to regular users.
• User Interaction: None.
• Scope: Changed — The attacker leverages LXD's privileged network position to probe and interact with internal services that are outside the attacker's direct network access and outside the scope of LXD's image management authorization.
• Confidentiality Impact: Low — Error messages reveal internal port states (open/closed/filtered) and service availability. Response bodies from internal services are NOT returned to the attacker (hash validation blocks content exfiltration).
• Integrity Impact: None — No demonstrated ability to modify data on internal services.
• Availability Impact: None — No meaningful resource exhaustion or denial of service.

Affected Component

• lxd/images.go — imgPostURLInfo (lines 668–755) — Makes HEAD request to user-supplied URL without any SSRF protections.
• lxd/util/http.go — HTTPClient (lines 102–147) — Creates HTTP client with no IP blocking or URL validation.
• shared/network.go — RFC3493Dialer (lines 20–49) — Dials arbitrary hosts including private/loopback ranges.
• lxd/daemon_images.go — ImageDownload (lines 478–510, "direct" case) — Makes GET request to URL from attacker-controlled response header.

Description

Core vulnerability: no SSRF protections on server-side image fetching

When a user imports an image from a URL, the imgPostURLInfo function makes an HTTP HEAD request directly to the user-supplied URL with zero validation:

// lxd/images.go:668-703
func imgPostURLInfo(ctx context.Context, s *state.State, req api.ImagesPost, ...) (*api.Image, error) {
    if req.Source.URL == "" {
        return nil, errors.New("Missing URL")
    }

    myhttp, err := util.HTTPClient("", s.Proxy)
    // ...

    // Resolve the image URL
    head, err := http.NewRequest("HEAD", req.Source.URL, nil)
    // No URL validation, no scheme check, no IP range check
    // ...

    raw, err := myhttp.Do(head)  // Makes request to arbitrary destination

The HTTP client is created via util.HTTPClient which uses shared.RFC3493Dialer — a standard dialer with zero private-IP filtering:

// shared/network.go:20-49
func RFC3493Dialer(context context.Context, network string, address string) (net.Conn, error) {
    host, port, err := net.SplitHostPort(address)
    // ...
    addrs, err := net.LookupHost(host)
    // ...
    for _, a := range addrs {
        c, err := net.DialTimeout(network, net.JoinHostPort(a, port), 10*time.Second)
        // No check: IsLoopback? IsPrivate? IsLinkLocalUnicast?
        // Connects to ANY resolved address including 127.0.0.1, 10.x.x.x, 169.254.169.254

The HTTP client also follows redirects unconditionally:

// lxd/util/http.go:139-144
myhttp.CheckRedirect = func(req *http.Request, via []*http.Request) error {
    // Replicate the headers
    req.Header = via[len(via)-1].Header
    return nil  // Always follows redirects — no destination validation
}

No SSRF protections exist anywhere in the codebase

An exhaustive search for private-IP checks (IsLoopback, IsPrivate, IsLinkLocalUnicast), URL allowlists, or SSRF-specific…