Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

LXD has arbitrary file read+write on host via templates/ symlink in malicious image

Fix availableCritical · CVSS 9.9

Published Nov 6, 2026 · updated Nov 6, 2026

What to do

  1. Upgrade to a fixed version: github.com/canonical/lxd 0.0.0-20260203144152-d1c8ba15d160.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/canonical/lxd

Vulnerable versions
< 0.0.0-20260203144152-d1c8ba15d160
Fixed in
0.0.0-20260203144152-d1c8ba15d160

Check your project: go list -m all | grep github.com/canonical/lxd

What changed

  1. Nov 6, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-73 External Control of File Name or Path

← All critical vulnerabilities