EUVD-2026-57513Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable LXD API with an authenticated low-privilege user (PR:L), consistent/low-complexity bypass (AC:L), and a scope change (S:C) as control crosses into a restricted project yielding full C/I/A impact.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
AnalysisAI
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallowed high-privilege configurations into restricted projects, defeating per-project security controls. The root cause is a time-of-check to time-of-use race in which LXD validates project restrictions before configuration merging finishes during cross-project instance copies. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated LXD client (TLS certificate or equivalent) holding permission to create instances and to perform cross-project instance copies into a target project that enforces restrictions - this maps to the CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H) describes a low-complexity, network-reachable attack requiring only low privileges, with a scope change reflecting that a low-privileged actor in one project escalates control into a restricted project - this is the primary driver of the 9.9 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated tenant with rights only in an unrestricted project crafts an instance whose configuration enables a high-privilege feature (e.g. a privileged or nested container), then issues a cross-project copy into a project that is supposed to forbid such settings. … |
| Remediation | Upgrade LXD to the fixed release identified in Canonical advisory GHSA-v989-qw7w-xvg4 (https://github.com/canonical/lxd/security/advisories/GHSA-v989-qw7w-xvg4); the exact patched version is not stated in the available data, so confirm it directly from that advisory (snap-based installs typically update automatically via the tracked channel). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Canonical LXD deployments using multi-project configurations and immediately restrict instance copy privileges to a minimal set of trusted administrators; enable comprehensive audit logging for all instance copy operations and review access grant history. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attacker
A arbitrary file access vulnerability (CVSS 6.5) that allows an attacker with instance configuration permissions. Risk
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privile
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authentica
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted proj
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today