In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
CVE-2026-34179 is a critical vulnerability in Canonical LXD versions 4.12 through 6.7 where the doCertificateUpdate function fails to validate the Type field in certificate update requests. This flaw allows a remote authenticated attacker with restricted TLS certificate user privileges to escalate their privileges to cluster admin. The vulnerability has a CVSS score of 9.1, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-34178 is a critical vulnerability in Canonical LXD before version 6.8 where improper input validation allows an authenticated attacker with instance-creation permissions in a restricted project to bypass project restrictions. The vulnerability arises because the backup import process validates project restrictions against one file in the backup archive but creates instances from a separate file that is not checked. This flaw can be exploited to set restricted security settings, potentially leading to full host compromise.
Canonical LXD versions 4.12 through 6.7 have a vulnerability due to an incomplete denylist in the isVMLowLevelOptionForbidden function. This omission allows a remote attacker with can_edit permission on a VM instance in a restricted project to inject AppArmor rules and QEMU chardev configurations. Exploiting this can lead to privilege escalation to LXD cluster administrator and potentially host root. The vulnerability is tracked as CVE-2026-34177 with a critical severity score of 9.1. No official patch or remediation guidance has been provided yet.
CVE-2026-28384 is a critical OS command injection vulnerability in Canonical's LXD container management system affecting versions 4.12 through 6.6. It arises from improper sanitization of the compression_algorithm parameter in API calls related to image and backup endpoints. An authenticated but unprivileged user can exploit this flaw to execute arbitrary commands with the privileges of the LXD daemon, potentially leading to full system compromise. The vulnerability requires no user interaction and has a CVSS 4.0 score of 9.4, reflecting its high impact on confidentiality, integrity, and availability. Fixed versions are available in specific snap channels starting from 5.0.
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.