{"id":"CVE-2025-54286","aliases":["GHSA-p8hw-rfjg-689h","GO-2025-4003"],"url":"https://o3.security/vulnerability/CVE-2025-54286","summary":"CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI","details":"Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.","published":"2025-10-02T09:12:49.044Z","modified":"2026-08-08T03:30:17.263815887Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"5.0.5"},{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"5.21.4"},{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"6.5"},{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"0.0.0-20250827065555-0494f5d47e41"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54286.json"},{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54286"},{"type":"PACKAGE","url":"https://github.com/canonical/lxd"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:30:17.263815887Z"}}