EUVD-2026-20874
GHSA-q96j-3fmm-7fv4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious backup archive with divergent YAML files
-
DeliveryUpload backup bypassing index.yaml validation
-
ExploitLXD imports from unchecked backup.yaml
-
ExecutionInstance created with security.privileged=true
-
ImpactAttacker gains full host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Canonical LXD before 6.8. Attacker must be authenticated with instance-creation permission in a restricted project. Attacker crafts malicious backup archive with restrictive settings in backup/container/backup.yaml (bypassing validation of backup/index.yaml). No victim interaction required. |
| Impact | Critical for LXD deployments hosting untrusted users. CVSS 9.1 reflects authenticated requirement (PR:H) but high-impact host compromise. Attacker with instance-creation rights bypasses all project restrictions via malformed backup archives, escalating to privileged containers. Patch availability reduces immediate risk, but unpatched systems face complete infrastructure compromise. |
| Exploit ScenarioDerived | Authenticated attacker with instance-creation permission crafts backup.tar containing benign backup/index.yaml (passes validation) but malicious backup/container/backup.yaml with security.privileged=true. LXD imports instance from unchecked second file, granting host-level access. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Backup import in Canonical LXD before 6.8 bypasses project security restrictions, enabling privilege escalation to full host compromise. An authenticated remote attacker with instance-creation permission in a restricted project crafts malicious backup archives containing conflicting configuration files: backup/index.yaml passes validation, while backup/container/backup.yaml (never validated) carries forbidden directives like security.privileged=true or raw.lxc commands. Exploiting this dual-file validation gap allows unrestricted container creation that breaks isolation boundaries. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Canonical LXD 6.8 or later, which enforces consistent validation of both backup/index.yaml and backup/container/backup.yaml against project restrictions. Upstream fix applied via https://github.com/canonical/lxd/pull/17921 detailed in security advisory https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4. Until patching, implement workarounds: revoke instance-creation permissions in restricted projects for non-administrative users, prohibit backup imports from untrusted sources, or disable backup import functionality entirely via API access controls. Monitor LXD audit logs for anomalous backup restoration events targeting restricted projects.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause: inconsistent validation logic (CWE-20). Import process validates project restrictions against backup/index.yaml but instantiates from backup/container/backup.yaml without restriction checks. Attacker-controlled discrepancy between these files in a single tar archive defeats enforcement, enabling injection of privileged container settings that should be blocked by project policies.
Know when Lxd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.
Executive ViewAI
Canonical LXD versions prior to 6.8 contain a critical privilege escalation vulnerability in backup import functionality that allows authenticated users to bypass project security restrictions and gain full host compromise through maliciously crafted backup archives. Organizations running LXD in multi-tenant environments face immediate risk of complete infrastructure takeover by users with basic instance-creation permissions, requiring urgent patching across all affected deployments.
Vendor-released patch: LXD 6.8. Interim mitigations pending patch deployment: (1) Restrict backup import functionality to administrators only; (2) Disable project-based multi-tenancy until upgrade; (3) Implement network segmentation isolating LXD hosts; (4) Monitor backup import operations and container creation events for anomalous configuration directives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Canonical LXD Security Bypass
View all 3Cross-site request forgery in the LXD-UI component of Canonical LXD 5.0 before 5.0.5, 5.1 before 5.21.4, and 6.0 before
Privilege escalation in Canonical LXD's operations API (LXD before 6.5 and LXD 5.21 before 5.21.4) allows an authenticat
Authenticated remote attackers with access to the Canonical LXD instance log retrieval or deletion endpoints can read ar
Server-side template injection in Canonical LXD's instance snapshot naming feature lets an authenticated user who can mo
Unauthenticated project enumeration in Canonical LXD 5.21.x before 5.21.4 and 6.x before 6.5 lets remote attackers deter
Unauthenticated remote attackers can confirm the existence of LXD projects on Canonical LXD by comparing HTTP status cod
Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup arc
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify wheth
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Exploit-DB