Go
LXD has restricted project bypass leading to arbitrary command execution
Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qe
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file write on client due to trusted image hash
Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the serve
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly le
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it se
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/sto
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260203144152-d1c8ba15d160 or later.
LXD has arbitrary file write on host via exec-output symlink in crafted image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named exec
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260626085134-124f90100640 or later.
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Summary kaniko before v1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img, is enough. The build nee
What to do: Upgrade github.com/chainguard-dev/kaniko to 1.25.20 or later.
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original de
What to do: Upgrade github.com/imgproxy/imgproxy/v3 to 4.0.16 or later.
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that co
What to do: Upgrade github.com/labstack/echo/v4 to 4.16.1 or later.
Graphalgo campaign moves upstream into infrastructure as code
First reported by ReversingLabs in February, the malware has moved to Terraform providers and Go modules. Here’s what you need to know.