Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

LXD has restricted project bypass leading to arbitrary command execution

Fix availableCritical · CVSS 9.9

Published Nov 6, 2026 · updated Nov 6, 2026

What to do

  1. Upgrade to a fixed version: github.com/canonical/lxd 0.0.0-20260630083100-c5184be310b1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/canonical/lxd

Vulnerable versions
< 0.0.0-20260630083100-c5184be310b1
Fixed in
0.0.0-20260630083100-c5184be310b1

Check your project: go list -m all | grep github.com/canonical/lxd

What changed

  1. Nov 6, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-862 Missing Authorization

← All critical vulnerabilities