In Canonical LXD prior to version 6.8, the backup import functionality validates project restrictions against the backup/index.yaml file within a supplied tar archive. However, the actual instance creation uses backup/container/backup.yaml, a separate file in the same archive that is not validated against project restrictions. This discrepancy allows an authenticated remote attacker with instance-creation permission in a restricted project to craft a malicious backup archive where backup.yaml contains restricted settings such as security.privileged=true or raw.lxc directives. Exploiting this flaw bypasses all project restriction enforcement, potentially leading to full host compromise. The vulnerability is tracked as CVE-2026-34178 with a CVSS 3.1 score of 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

An attacker with authenticated instance-creation permissions in a restricted project can bypass project restrictions by exploiting improper input validation in the backup import process. This can lead to the creation of instances with elevated privileges or restricted configurations, resulting in full host compromise. The impact is critical, affecting confidentiality, integrity, and availability of the host system running vulnerable LXD versions.

Patch status is not yet confirmed — no official fix or patch information is provided in the vendor advisory or other sources. Users should monitor Canonical's official advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restrict instance-creation permissions to trusted users only and avoid importing backups from untrusted sources.