6.8

CVE-2025-54288: canonical lxd Authentication Bypass by Spoofing

CVSS: 6.8v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-54288DEBIAN-CVE-2025-54288GHSA-7232-97c6-j525
Published 02-10-2025Last modified 02-10-2025
Open JSON

Vulnerability summary

CVE-2025-54288 is a medium (CVSS 6.8) Authentication Bypass by Spoofing vulnerability in canonical lxd. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
37/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.8/10
010
Medium · v3.1 (NVD)
EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 2
DSA-6027-1DSA-6028-1OPENSUSE-SU-2025:15710-1OPENSUSE-SU-2026:21483-1

Timeline

  1. 02-10-2025
    PublishedVulnerability first disclosed.
  2. 02-10-2025
    Last modifiedVulnerability information updated.

Description

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

CVSS metrics

8 scores · 5 sources · 2 versions

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

0.00 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Lxd

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • incus< 6.0.4-2+deb13u1 | < 6.0.5-1
  • lxdAll versions (No fix recorded) | < 5.0.2+git20231211.1364ae4-9+deb13u1
Canonical1 product
  • lxd≥ 6.0, < 6.5 | ≥ 5.21, < 5.21.4 | ≥ 4.0.0, < 5.21.4 | ≥ 6.1, < 6.5
Github.com/canonical1 product
  • lxd≥ 4.0, < 5.21.4 | ≥ 6.0, < 6.5 | ≥ 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Ubuntu1 product
  • lxdAll versions (No fix recorded)

4 vendors · 5 products

References

7 links