{"schema_version":"1.9.0","id":"CVE-2025-54286","published":"2025-10-02T09:12:49.044Z","modified":"2026-08-12T03:51:14.463715908Z","aliases":["GHSA-p8hw-rfjg-689h","GO-2025-4003"],"related":["openSUSE-SU-2025:15710-1","openSUSE-SU-2026:21483-1"],"summary":"CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI","details":"Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/canonical/lxd","events":[{"introduced":"1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1"},{"fixed":"4ef455e67d5ea672dc2602f41530b1683e1ab5f1"},{"introduced":"761d134ceabd306f57acfb0ca51f59b03751a5b0"},{"fixed":"0494f5d47e41af69a8374568c0cb8b3eefd72a6a"},{"introduced":"0"},{"fixed":"fec3cc832ca782d398c82d38f8532ef9d5be2e00"}],"database_specific":{"extracted_events":[{"introduced":"5.0"},{"fixed":"5.0.5"},{"introduced":"5.21"},{"fixed":"5.21.4"},{"introduced":"6.0"},{"fixed":"6.5"}],"source":"AFFECTED_FIELD"}}],"versions":["lxd-5.17","lxd-5.16","lxd-5.15","lxd-5.14","lxd-5.13","lxd-5.12","lxd-5.11","lxd-5.0.2","lxd-5.10","lxd-5.9","lxd-5.8","lxd-5.7","lxd-5.6","lxd-5.5","lxd-5.0.1","lxd-5.4","lxd-5.3","lxd-5.2","lxd-5.1","lxd-5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54286.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54286.json"},{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54286"},{"type":"PACKAGE","url":"https://github.com/canonical/lxd"}],"database_specific":{"cna_assigner":"canonical","cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54286.json"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}]}