Threats tagged 'ghsa-hhf9-qw4v-72xp'

A vulnerability in LXD allows a guest container to mount and access another guest's custom storage volume without ownership. This occurs because the device-update path that attaches volumes to containers does not verify volume ownership, enabling tenants with the 'security.devlxd.management.volumes' permission to hijack volumes from other tenants within the same project. The flaw affects LXD versions prior to the fixed commit 0.0.0-20260626085133-7cb96ac80a6d and has a high severity CVSS score of 8.4.