EUVD-2026-39794Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
API-reachable with low complexity, needs an existing operator account (PR:L); escaping a confined project to host root is a scope change (S:C) with full host compromise.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.
AnalysisAI
Privilege escalation in Canonical LXD (versions 6.0-6.8, 5.21.0-5.21.4, and 5.0.0-5.0.6) allows an authenticated project operator in a restricted multi-tenant deployment to escape tenant confinement and obtain host root. Because project-restriction policies are not re-validated when an instance backup is imported and its snapshot restored, an operator can smuggle restricted configuration keys into a snapshot, restore them onto the live instance, and start it to gain unauthorized root on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch and the fixing source code are available.
Technical ContextAI
LXD is Canonical's system container and virtual-machine manager that supports multi-tenancy through 'projects' with restriction policies (the project restricted.* settings) that block tenants from setting dangerous instance configuration keys such as security/privilege-related and volatile keys. The root cause is CWE-863 (Incorrect Authorization): the createFromBackup code path in lxd/instances_post.go validated project permissions against the backup's top-level instance definition but never iterated over the snapshot definitions inside the backup. As shown in PR #18301, the original code called limits.AllowInstanceCreation only once; the fix refactors AllowInstanceCreation to take a pre-fetched ProjectInfo and additionally loops over bInfo.Config.Snapshots, calling AllowInstanceCreation for each snapshot so restricted keys are checked. The patch also extends checkRestrictionsOnVolatileConfig to cover additional volatile keys (volatile.cloud-init.instance-id and volatile.uuid.generation), indicating restricted volatile state inside snapshots was part of the bypass surface. The affected component per CPE is cpe:2.3:a:canonical:lxd.
RemediationAI
Vendor-released patch: upgrade to LXD 6.9, 5.21.5, or 5.0.7 or later depending on your branch, per advisory GHSA-ppq7-4492-5552 (https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552); the corresponding code fixes are in https://github.com/canonical/lxd/pull/18301, /18303 and /18304. If you cannot patch immediately, the most effective compensating control is to prevent untrusted operators from importing backups: restrict or revoke the ability of restricted-project operators to create instances from backup files (the createFromBackup / 'lxc import' path), or only accept backups from trusted sources and inspect them before restore, since the bypass depends on a maliciously crafted backup. Reducing the number of accounts holding project operator privileges and auditing existing restricted-project instances for unexpected restricted configuration or volatile keys also limits exposure; the trade-off of blocking backup import is loss of self-service restore for tenants until the upgrade is applied.
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attacker
A arbitrary file access vulnerability (CVSS 6.5) that allows an attacker with instance configuration permissions. Risk
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privile
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallo
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authentica
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today