Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-54288

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

Published

2025-10-02T10:15:38.887

Last Modified

2025-10-24T14:44:18.773

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-290

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	canonical	lxd	< 5.21.4	Yes
Application	canonical	lxd	< 6.5	Yes
Operating System	linux	linux_kernel	-	No

References

https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525 Exploit, Vendor Advisory ([email protected])
https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525 Exploit, Vendor Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)