Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Fix availableCritical · CVSS 9.9

Published Nov 6, 2026 · updated Nov 6, 2026

What to do

  1. Upgrade to a fixed version: github.com/canonical/lxd 0.0.0-20260626085134-124f90100640.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/canonical/lxd

Vulnerable versions
< 0.0.0-20260626085134-124f90100640
Fixed in
0.0.0-20260626085134-124f90100640

Check your project: go list -m all | grep github.com/canonical/lxd

What changed

  1. Nov 6, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-73 External Control of File Name or Path

← All critical vulnerabilities