CVE-2026-34177 is a critical vulnerability in Canonical LXD (versions 4.12 through 6.7) caused by an incomplete denylist in the isVMLowLevelOptionForbidden function. Specifically, the keys raw.apparmor and raw.qemu.conf are not blocked under the restricted.virtual-machines.lowlevel=block project restriction. This allows a remote attacker with can_edit permission on a VM instance within a restricted project to inject malicious AppArmor rules and QEMU chardev configurations. Such injection can bridge the LXD Unix socket into the guest VM, enabling privilege escalation to the LXD cluster administrator role and subsequently to host root privileges. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability with scope change.

An attacker with can_edit permission on a VM instance in a restricted project can escalate privileges to LXD cluster administrator and then to host root. This compromises the confidentiality, integrity, and availability of the host and cluster environment. The vulnerability affects LXD versions 4.12 through 6.7. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict can_edit permissions carefully and monitor for suspicious activity related to VM configuration changes. Avoid granting can_edit permissions in restricted projects where possible.