VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Mar 3, 2026· Updated Mar 5, 2026

Authorization Bypass in LXD GET /1.0/certificates Endpoint

CVE-2026-3351

Description

Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/canonical/lxdGo
< 0.0.0-20260224152359-d936c90d47cf0.0.0-20260224152359-d936c90d47cf

Affected products

1

Patches

1
d936c90d47cf

lxd/certificates: Return only allowed certificates in non-recursive list (#17738)

https://github.com/canonical/lxdTom ParrottFeb 24, 2026via ghsa
commit
1 file changed · +5 −9
  • lxd/certificates.go+5 −9 modified
    @@ -151,10 +151,10 @@ func certificatesGet(d *Daemon, r *http.Request) response.Response {
 	}
 
 	var certResponses []*api.Certificate
-	var baseCerts []dbCluster.Certificate
+	var certURLs []string
 	urlToCertificate := make(map[*api.URL]auth.EntitlementReporter)
 	err = d.State().DB.Cluster.Transaction(r.Context(), func(ctx context.Context, tx *db.ClusterTx) error {
-		baseCerts, err = dbCluster.GetCertificates(ctx, tx.Tx())
+		baseCerts, err := dbCluster.GetCertificates(ctx, tx.Tx())
 		if err != nil {
 			return err
 		}
@@ -173,6 +173,8 @@ func certificatesGet(d *Daemon, r *http.Request) response.Response {
 
 				certResponses = append(certResponses, apiCert)
 				urlToCertificate[entity.CertificateURL(apiCert.Fingerprint)] = apiCert
+			} else {
+				certURLs = append(certURLs, api.NewURL().Path(version.APIVersion, "certificates", baseCert.Fingerprint).String())
 			}
 		}
 
@@ -183,13 +185,7 @@ func certificatesGet(d *Daemon, r *http.Request) response.Response {
 	}
 
 	if !recursion {
-		body := []string{}
-		for _, baseCert := range baseCerts {
-			certificateURL := api.NewURL().Path(version.APIVersion, "certificates", baseCert.Fingerprint).String()
-			body = append(body, certificateURL)
-		}
-
-		return response.SyncResponse(true, body)
+		return response.SyncResponse(true, certURLs)
 	}
 
 	if len(withEntitlements) > 0 {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.