CVE-2026-34179

Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

State: Published
Severity: 9.1 Critical
Published: Apr 9, 2026
Updated: Apr 9, 2026
Reserved: Mar 26, 2026

Description

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	canonical

Weaknesses

CWE-915 Improperly controlled modification of Dynamically-Determined object attributes

Affected Products

Product	Versions
lxdCanonical	4.12.0 to before 5.0.7Affected 5.1.0 to before 5.21.5Affected 6.0.0 to before 6.8.0Affected

References

Update of type field in restricted TLS certificate allows privilege escalation to cluster adminvdb-entryvendor-advisory
Improve validation on certificate editpatchissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.