CVE-2026-28385

## Summary The LXD image import-from-URL endpoint (`POST /1.0/images` with `source.type=url`) makes server-side HTTP requests to an attacker-supplied URL without any private-IP or loopback blocking. An authenticated user with the `can_create_images` entitlement can force the LXD daemon to connect to internal network addresses (127.0.0.1, RFC1918 ranges, cloud metadata endpoints), enabling port scanning via error-based inference and interaction with internal HTTP services from the daemon's privileged network position. ## Severity - **Attack Vector:** Network — LXD API is network-accessible. - **Attack Complexity:** Low — Single crafted API request with no special conditions. - **Privileges Required:** Low — Requires `can_create_images` entitlement, a non-admin permission commonly delegated to regular users. - **User Interaction:** None. - **Scope:** Changed — The attacker leverages LXD's privileged network position to probe and interact with internal services that are outside the attacker's direct network access and outside the scope of LXD's image management authorization. - **Confidentiality Impact:** Low — Error messages reveal internal port states (open/closed/filtered) and service availability. Response bodies from internal services are NOT returned to the attacker (hash validation blocks content exfiltration). - **Integrity Impact:** None — No demonstrated ability to modify data on internal services. - **Availability Impact:** None — No meaningful resource exhaustion or denial of service. ## Affected Component - `lxd/images.go` — `imgPostURLInfo` (lines 668–755) — Makes HEAD request to user-supplied URL without any SSRF protections. - `lxd/util/http.go` — `HTTPClient` (lines 102–147) — Creates HTTP client with no IP blocking or URL validation. - `shared/network.go` — `RFC3493Dialer` (lines 20–49) — Dials arbitrary hosts including private/loopback ranges. - `lxd/daemon_images.go` — `ImageDownload` (lines 478–510, "direct" case) — Makes GET request to URL from