Read the docs
TI-2026-10656 Aliases CVE-2026-12411GHSA-hhf9-qw4v-72xp

Broken Access Control in Canonical LXD DevLXD API

Priority HIGH 76CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed lxd (Canonical): 6.9github.com/canonical/lxd (Go): 0.0.0-20260626085133-7cb96ac80a6d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicallxd6.6 to before 6.96.9Patch availableCNA
—github.com/canonical/lxd (Go)0.0.0-20250721152936-fe86ceb2c3fa to before 0.0.0-20260626085133-7cb96ac80a6d0.0.0-20260626085133-7cb96ac80a6dPatch availableGHSA-hhf9-qw4v-72xp
  • lxd VendorCanonical Affected 6.6 to before 6.9 Fixed in 6.9 Patch available CNA
  • github.com/canonical/lxd (Go) Vendor— Affected 0.0.0-20250721152936-fe86ceb2c3fa to before 0.0.0-20260626085133-7cb96ac80a6d Fixed in 0.0.0-20260626085133-7cb96ac80a6d Patch available GHSA-hhf9-qw4v-72xp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*6.6 to before 6.9VulnerableCanonical
  • cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Versions 6.6 to before 6.9 Vulnerable ·Canonical

Remediation

  • Fix · CNA lxd (Canonical) Fixed in 6.9
  • Fix · GHSA-hhf9-qw4v-72xp github.com/canonical/lxd (Go) Fixed in 0.0.0-20260626085133-7cb96ac80a6d Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12411
  2. 2026-11-05 Alias added: GHSA-hhf9-qw4v-72xp
  3. 2026-11-05 Fix available: Go/github.com/canonical/[email protected] · GHSA-hhf9-qw4v-72xp
  4. 2026-11-05 CVSS score added · GHSA-hhf9-qw4v-72xp
  5. 2026-11-05 Weakness changed · GHSA-hhf9-qw4v-72xp
  6. 2026-11-05 5 new references · GHSA-hhf9-qw4v-72xp

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-22659 Authenticated RCE via unsanitized compression_algorithm CVSS 4.0CRITICAL 9.4
  • TI-2026-47475 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVSS 3.1CRITICAL 9.9
  • TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command execution CVSS 3.1CRITICAL 9.9
  • TI-2026-45143 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
  • TI-2026-45142 Project restriction bypass via instance migration config override CVSS 3.1CRITICAL 9.9
  • TI-2026-45140 Root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences