Vulnerability · Published Jun 26, 2026 · Assigned by canonical
CVE-2026-12411Broken Access Control in Canonical LXD DevLXD API
High 8.4
In plain English
A high-severity authorization bypass via user-controlled key in lxd from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 85.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/canonical/lxd | 0.0.0-20260626085133-7cb96ac80a6d | GHSA-hhf9-qw4v-72xp |
| Go | github.com/canonical/lxd | 0.0.0-20260626085133-7cb96ac80a6d | GO-2026-6917 |
Affected products (as reported)
Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
- Cross-guest volume hijack via DevLXD device patch vdb-entry, vendor-advisory
- Security fixes from the 6.9 release patch