Skip to content
Canonical Lxd vulnerabilities
-
canonical lxd
Improper certificate validation in the HTTPS listener in LXD
CVE-2026-112816
Public exploit
10.0 Critical
-
canonical lxd
LXD client recursive file pull allows directory escape via malicious VM agent
CVE-2026-87798
5.8 Medium
-
canonical lxd
Arbitrary file write on LXD host via symlink in migration stream
CVE-2026-87799
9.9 Critical
-
canonical lxd
Incorrect authorization in LXD storage volume API allows reading volumes from other projects
CVE-2026-97335
7.7 High
-
canonical lxd
Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
CVE-2026-85185
Fix available
9.6 Critical
-
canonical lxd
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
CVE-2026-85526
Fix available
9.9 Critical
-
canonical lxd
LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
CVE-2026-86335
6.3 Medium
-
canonical lxd
CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
CVE-2026-86334
4.2 Medium
-
canonical lxd
Instance template path traversal allows arbitrary host file write as root
CVE-2026-66897
9.9 Critical
-
canonical lxd
Arbitrary file read+write on host via templates/ symlink in malicious image
CVE-2026-16033
8.5 High
-
canonical lxd
Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
CVE-2026-66898
9.9 Critical
-
canonical lxd
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
CVE-2026-63293
9.9 Critical
-
canonical lxd
Root RCE via image backup.yaml symlink
CVE-2026-63294
9.9 Critical
-
canonical lxd
Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
CVE-2026-63295
4.3 Medium
-
canonical lxd
Project restriction bypass via instance migration config override
CVE-2026-63296
9.9 Critical
-
canonical lxd
Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
CVE-2026-63297
9.9 Critical
-
canonical lxd
LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
CVE-2026-63298
8.7 High
-
canonical lxd
Storage volume cross-project move and snapshot restore bypass project disk limits
CVE-2026-63299
8.5 High
-
canonical lxd
Cross-project cluster migration bypasses project restrictions via cluster notification flag
CVE-2026-62420
9.9 Critical
-
canonical lxd
Cross-project instance move bypasses all project restrictions allowing host command execution
CVE-2026-63300
9.9 Critical
-
lxc incus, canonical lxd +1 more
Incus has arbitrary file read+write on host via templates/ symlink in malicious image
CVE-2026-48752
Fix available
9.9 Critical
-
lxc incus, canonical lxd +1 more
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
CVE-2026-48749
Fix available
9.9 Critical
-
canonical lxd
SSRF via image import from URL allows internal network probing by authenticated users
CVE-2026-28385
Fix available
5.0 Medium
-
canonical lxd
LXD Snapshot Import Privilege Escalation Vulnerability
CVE-2026-9640
Fix available
7.2 High
-
canonical lxd
Authenticated Denial of Service via Malicious Backup Tarball in LXD
CVE-2026-9639
Fix available
6.5 Medium
-
canonical lxd
Broken Access Control in Canonical LXD DevLXD API
CVE-2026-12411
Fix available
8.4 High
-
canonical lxd
Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
CVE-2026-34179
Fix available
9.1 Critical
-
canonical lxd
Importing a crafted backup leads to project restriction bypass
CVE-2026-34178
Fix available
9.1 Critical
-
canonical lxd
VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
CVE-2026-34177
Fix available
9.1 Critical
-
canonical lxd
Authenticated RCE via unsanitized compression_algorithm
CVE-2026-28384
Fix available
9.4 Critical
-
canonical lxd
Authorization Bypass in LXD GET /1.0/certificates Endpoint
CVE-2026-3351
Fix available
2.1 Low
-
canonical lxd
Path Traversal in LXD Instance Log File Retrieval
CVE-2025-54293
Fix available
7.1 High
-
canonical lxd
Client-Side Path Traversal in LXD-UI
CVE-2025-54292
4.8 Medium
-
canonical lxd
Project existence disclosure in LXD images API
CVE-2025-54291
Fix available
6.9 Medium
-
canonical lxd
Project Existence Disclosure via Error Handling in LXD Image Export
CVE-2025-54290
Fix available
6.9 Medium
-
canonical lxd
Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
CVE-2025-54289
Fix available
7.4 High
-
canonical lxd
Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
CVE-2025-54288
Fix available
5.1 Medium
-
canonical lxd
Arbitrary File Read via Template Injection in Snapshot Patterns
CVE-2025-54287
Fix available
7.1 High
-
canonical lxd
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
CVE-2025-54286
Fix available
7.5 High
-
canonical lxd
lxd has a restricted TLS certificate privilege escalation when in PKI mode
CVE-2024-6219
Fix available
3.8 Low
-
canonical lxd
lxd CA certificate sign check bypass
CVE-2024-6156
Fix available
3.8 Low
-
canonical lxd, tianocore edk2 +1 more
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS...
CVE-2023-49721
Fix available
6.7 Medium
-
tianocore edk2, canonical lxd, canonical ltd. ubuntu edk ii +1 more +3 more
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an...
CVE-2023-48733
Fix available
6.7 Medium
-
canonical lxd
chmod race in doUidshiftIntoContainer
CVE-2015-1340
Fix available
7.0 High
-
canonical lxd, ubuntu linux +1 more
lxd vulnerabilities
CVE-2016-1582
Fix available
5.5 Medium
-
canonical lxd, ubuntu linux +1 more
lxd vulnerabilities
CVE-2016-1581
Fix available
5.5 Medium