Is github.com/canonical/lxd safe ? github.com/canonical/lxd (go) has 25 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 5 direct dependencies
2 carry known advisories, worst HIGH
1 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-jpf8-86f3-wp38, the advisory selected below
// 25 advisories GHSA-jpf8-86f3-wp38 Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 CRIT GHSA-fmc8-p6q7-75cc Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 CRIT GHSA-9j25-mm2h-2f76 Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv CRIT GHSA-vghh-5rfx-xhq8 Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv CRIT GHSA-pjff-c2wc-f6jm Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x CRIT GHSA-47w9-6r3f-938g Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv CRIT GHSA-q96j-3fmm-7fv4 LXD instance backup import validates project restrictions against backup/index.yaml embedded in the tar archive, but creates the actual instance from… CRIT GHSA-fm2x-c5qw-4h6f The isVMLowLevelOptionForbidden function in lxd/project/limits/permissions.go is missing raw.apparmor and raw.qemu.conf from its hardcoded forbidden list. CRIT GHSA-c3h3-89qf-jqm5 A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to… CRIT GHSA-qx75-2p3r-pwm5 Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg HIGH Show all 25 advisories Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479
Full advisory text at GitHub advisory .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High // fixed in 0.0.0-20260203144152-d1c8ba15d160
go get github.com/canonical/lxd@v0.0.0-20260203144152-d1c8ba15d160 upgrade past every affected range above
// at a glance Affected < 0.0.0-20260203144152-d1c8ba15d160 Fixed in 0.0.0-20260203144152-d1c8ba15d160 Weakness CWE-73 Published 2026-11-06 Sources github // questions Is github.com/canonical/lxd safe to install? CyberXYZ does not call a package safe in absolute terms. It records 25 known vulnerabilities for github.com/canonical/lxd (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/canonical/lxd have known vulnerabilities? Yes. CyberXYZ records 25 known vulnerabilities for github.com/canonical/lxd (go), the worst rated CRITICAL. These include GHSA-jpf8-86f3-wp38, GHSA-fmc8-p6q7-75cc, GHSA-9j25-mm2h-2f76, GHSA-vghh-5rfx-xhq8, GHSA-pjff-c2wc-f6jm.
How do I check github.com/canonical/lxd before installing? Search github.com/canonical/lxd in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fcanonical%2Flxd . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-15 at 08:10 UTC. The most recent advisory here was published 2026-11-06. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page