Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2025-54289: LXD allows attackers to hijack terminals and run commands
CVE-2025-54289 · published 1 year ago
Summary
Versions of Canonical’s LXD container manager before 6.5 let a user with only read access take over active terminal or console sessions. By hijacking the communication link, they can issue their own commands and potentially gain full control of the system. Upgrade LXD to version 6.5 or later and restrict read‑only access to the operations API.
What to do
- Update github.com canonical to version 5.21.4.
- Update github.com canonical to version 6.5.
- Update github.com canonical to version 0.0.0-20250827065555-0494f5d47e41.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | canonical |
>= 4.0, < 5.21.4 >= 6.0, < 6.5 >= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41 Fix: upgrade to 5.21.4
|
| – | canonical | lxd |
>= 4.0.0, < 5.21.4 >= 6.1, < 6.5 cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | lxd | All versions |
Original advisory text
Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
References
- https://pkg.go.dev/vuln/GO-2025-3999
- https://github.com/advisories/GHSA-3g72-chj4-2228
- https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-54289 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-54289 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-54289 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54289... Vendor Advisory
- https://github.com/canonical/lxd Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-1385Missing Origin Validation in WebSockets
Timeline
Published2 Oct 2025
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-3g72-chj4-2228 · GHSA
CVE-2025-54289 · NVD
UBUNTU-CVE-2025-54289 · OSV
CVE-2025-54289 · OSV
Track software like this
Free during beta