CVE-2026-12411

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Score

CVSS 3.1 9.6 Critical

Status

Analyzed - security@ubuntu.com

Published

2026-06-26

Last modified

2026-10-25

Weaknesses

CWE-639, CWE-862

Affected products

• Lxd (Canonical)

References

• https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp
• https://github.com/canonical/lxd/pull/18585