EUVD-2026-57418Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated project user (PR:L) over the network API (AV:N/AC:L); impact is storage over-allocation, so A:H with minor integrity (I:L) and no confidentiality, and no scope change.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
AnalysisAI
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authenticated user exceed the disk and volume limits an administrator configured on a project. The flaw stems from two code paths - cross-project volume moves (storagePoolVolumeTypePostMove) and volume snapshot restores with a nil config - that skip the AllowVolumeCreation/AllowVolumeUpdate limit checks, enabling over-allocation of storage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated LXD user (CVSS PR:L) holding permissions to perform volume operations within a project that has configured disk/volume limits - specifically the ability to trigger a cross-project volume move (storagePoolVolumeTypePostMove) or to restore a volume snapshot where the volume configuration is nil (Config == nil). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict and should be reconciled before treating this as a top-tier crisis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A tenant with legitimate access to an LXD project that has a strict storage quota repeatedly moves volumes in from another project (or restores snapshots on volumes with nil config), each operation slipping past the AllowVolumeCreation/AllowVolumeUpdate check. Over successive operations the tenant allocates storage well beyond the project's limits.disk ceiling, exhausting the shared storage pool and degrading service for co-located tenants. … |
| Remediation | Vendor-released patch: upgrade to LXD 5.0.8, 5.21.6, or 6.10 (whichever matches your branch) as the primary fix, per Canonical advisory GHSA-5h78-p252-989h (https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all LXD deployments to identify affected versions (5.0.x before 5.0.8, 5.21.x before 5.21.6, 6.0 before 6.10) and document which systems store critical or production workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attacker
A arbitrary file access vulnerability (CVSS 6.5) that allows an attacker with instance configuration permissions. Risk
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privile
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallo
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted proj
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today