Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by canonical

CVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projects

High 7.7

In plain English

A high-severity incorrect authorization in LXD from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.2%top 89.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lxdno fix listedDEBIAN-CVE-2026-97335
Debian:13lxdno fix listedDEBIAN-CVE-2026-97335

Affected products (as reported)

VendorProductVersions
Canonical LXD 5.0.0 – before 5.0.105.21.0 – before 5.21.86.0 – before 6.10

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References