The flaw is an authorization bypass in the GET /1.0/certificates API in Canonical LXD 6.6 on Linux. An authenticated, restricted user can call this endpoint and retrieve the fingerprints of all certificates that the LXD server trusts. This disclosure can give an attacker insight into the server’s trust store, potentially aiding further attacks or revealing sensitive configuration information.

Canonical LXD 6.6 running on Linux distributions.

The CVSS score of 2.1 ranks this as low severity, and the EPSS score indicates a very low likelihood of exploitation. The vulnerability requires the attacker to be authenticated with restricted privileges, a condition that is only met by legitimate but potentially limited users. Because the exploitation does not lead to code execution or full system compromise, the overall risk to confidentiality or integrity is modest, though disclosure of certificate fingerprints could assist in social engineering or credential gathering.