CVE-2025-54289: Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-02 · updated 2026-10-23
Weakness: CWE-1385

Description

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

Affected products

Canonical LXD: from 4.0.0 before 5.21.4; from 6.1 before 6.5 — fixed in 5.21.4, 6.5

How to fix

Upgrade to a fixed version: Canonical LXD 5.21.4, 6.5. Check the vendor advisory for mitigations.

References

https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228
https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228

Get alerted when CVE-2025-54289 or the next vulnerability affects your stack