In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function does not validate the Type field when handling PUT or PATCH requests to the /1.0/certificates/{fingerprint} endpoint for restricted TLS certificate users. This omission allows a remote authenticated attacker that can perform certificate updates to change the certificate type and consequently elevate their privileges to cluster admin. The flaw represents a classic privilege‑escalation vulnerability as defined by CWE‑915, potentially giving full control over the cluster.

The vulnerability affects Canonical's LXD container hypervisor, specifically versions 4.12 through 6.7. Users running LXD at these release levels and utilizing the certificate management API are at risk.

The CVSS score of 9.1 indicates high severity, and the flaw is exploitable by any authenticated user with certificate update permissions. Because the attacker must first authenticate to LXD, the threat is confined to compromised or less privileged accounts within the same cluster, but the impact reaches cluster‑wide administrative control. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting it may not yet be broadly exploited in the wild.