Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/canonical/lxd(Go) | 4.0 | 5.21.4 | N/A |
| github.com/canonical/lxd(Go) | 6.0 | 6.5 | N/A |
| github.com/canonical/lxd(Go) | 0.0.0-20200331193331-03aab09f5b5c | 0.0.0-20250827065555-0494f5d47e41 | N/A |
CVSS Metrics
