Vulnerabilities

TI-2026-45139 CVE-2026-63293

Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

HIGH 76

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00592 Published 2026-08-12 Fixed in 4.0.12, 5.0.8 +2 CWE-59

TI-2026-45140 CVE-2026-63294

HIGH 76

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00878 Published 2026-08-12 Fixed in 4.0.12, 5.0.8 +2 CWE-59

TI-2026-45141 CVE-2026-63295

MEDIUM 53

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00349 Published 2026-08-12 Fixed in 4.0.12, 5.0.8 +2 CWE-863