In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin.
| Vendor | Product | Versions |
|---|---|---|
| canonical | lxd | 4.12.0, 5.1.0, 6.0.0 |
Updated affected versions to include 5.0.6, 5.21.4, and 6.7, and corrected exploit availability and active exploitation status.
Initial creation
