CVE-2025-54289
8.1HighPublished 02 Oct 2025 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-1385
Impact
Authenticated attackers with read permissions can hijack container console or terminal sessions and execute arbitrary commands. They only need low-privilege API access to intercept active WebSocket operations.
Root cause
The operations API permits unauthorized users to connect to and hijack active terminal and console WebSockets.
Affected systems
Canonical LXD versions prior to 6.5.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Canonical LXD to version 6.5 or later. If upgrading must wait, restrict network access to the LXD API socket/port and revoke read access for untrusted accounts.
$ sudo snap refresh lxdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
References
- https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228ExploitVendor Advisory
- https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228ExploitVendor Advisory