CVE-2026-93336 is a missing authorization vulnerability in Canonical Juju versions 4.0 through 4.0.15. It allows a controller-authenticated principal, such as a unit agent or a user with only login permission, to read any application's charm resource across any model. This includes sensitive data like container-registry credentials, accessible via a crafted request specifying an arbitrary unit.
CVE-2026-102631 is an improper authentication vulnerability in Canonical's authd before version 0.7.1. The flaw occurs because authd resolves user identity by broker-scoped provider ID but falls back to username matching without rejecting conflicting non-empty provider IDs. This can cause a new user to inherit the previous user's local UID and home directory if an identity provider reassigns an email address. Consequently, the new user can access and modify files, including sensitive credentials like SSH keys and cloud API tokens, belonging to the previous user. Administrators are advised to lock or delete the previous user's local authd account when the corresponding identity provider account is removed.
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).
CVE-2026-12392 is an information exposure vulnerability in Canonical MAAS that allows unauthenticated attackers to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. This affects versions prior to 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0. The vulnerability requires that the target machine was deployed with the 'register as rack' option enabled and that the attacker can obtain or infer the machine's system ID to exploit the flaw.
CVE-2026-102371 is a medium severity vulnerability in Canonical's Ubuntu Pro for WSL service component before version 0.1.19ubuntu3. The service runs as root inside each WSL instance and attaches the instance to Ubuntu Pro by executing the pro client with the subscription token passed as a command-line argument. On systems where /proc is mounted without process-hiding mitigations (the default in WSL), unprivileged local users can read the token from the command line of the running attach process. This token leakage could allow unauthorized attachment of other machines to the victim's Ubuntu Pro subscription, granting access to Ubuntu Pro services.
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.
CVE-2026-87799 is a critical vulnerability in Canonical LXD affecting versions 4.0.0 up to but not including 4.0.14, 5.0.0 up to 5.0.10, 5.21.0 up to 5.21.8, and 6.0 up to 6.10. It involves improper link resolution in the migration receive path, allowing an authenticated client with certain permissions or a malicious migration source server to write arbitrary files as root on the host. This can lead to full host compromise. The issue is exploited via crafted rsync or btrfs send streams that plant symlinks in transferred volumes.
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
CVE-2026-85526 is a critical path traversal vulnerability in the Btrfs storage driver of Canonical LXD on Linux. It allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem with root privileges by exploiting a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.
CVE-2026-66897 is a critical path traversal vulnerability in Canonical's LXD container management software. It allows an attacker with container edit permissions or a user launching a crafted image to overwrite arbitrary files on the host system as root. The flaw arises from a mismatch between path validation and file creation during instance template processing, enabling escape from directory confinement and host root code execution.
CVE-2026-77113 is a medium severity vulnerability in Canonical Apport affecting versions prior to 2.36.0, 2.34.2, and 2.28.4. It involves a relative path traversal flaw in the apport-unpack component on Linux systems. This flaw allows an attacker to create or overwrite arbitrary files with the privileges of the executing user by manipulating key names in crash report files.
CVE-2026-61898 is an OS command injection vulnerability in Canonical's accountsservice affecting certain Ubuntu-specific language helper scripts. The vulnerability arises because these scripts treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input and interpolate it unescaped into a GNU sed replacement expression. This allows an attacker to inject arbitrary shell commands executed with root privileges via the SetLanguage D-Bus method. The issue affects multiple specific versions of accountsservice prior to 23.13.9-8ubuntu7. The vulnerability has a high severity score of 7.8 CVSS v3.1.
CVE-2026-61897 is a local privilege escalation vulnerability in Ubuntu's accountsservice prior to version 23.13.9-8ubuntu7. The flaw arises because an Ubuntu-specific patch only partially drops privileges before launching language helper scripts, leaving the real user ID as root. This allows a shell spawned by the helper script to inherit root privileges and potentially regain full root access. The vulnerability has a high severity with a CVSS score of 7.8.
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.