canonical

CVE-2026-9639: CVE-2026-9639: Authenticated Denial of Service via Nil-Pointer Dereference in Canonical LXD Custom Volume… CVE-2026-9639: Authenticated Denial of Service via Nil-Pointer Dereference in Canonical LXD Custom Volume Backup Import > Vulnerability ID: CVE-2026-9639 > CVSS Score: 6.5 > Published: 2026-11-06 CVE-2026-9639 (GHSA-j93m-3j9p-m5m8) is a null pointer dereference vulnerability in Canonical LXD affecting versions 5.0.0 through 5.21.4 and 6.0 through 6.8. The flaw resides in the (*lxdBackend).CreateCustomVolumeFromBackup method within lxd/storage/backend_lxd.go. An authenticated attacker with the can_create_storage_volumes permission can upload a crafted custom volume backup tarball that omits the expires_at field on a snapshot entry, triggering an unhandled SIGSEGV panic and terminating the LXD daemon. TL;DR An unguarded pointer dereference on snapshot expiration timestamps during custom storage volume backup restoration allows authenticated users with volume creation privileges to crash the Canonical LXD daemon via a malformed backup archive. --- ⚠️ Exploit Status: POC Technical Details - Vulnerability Class: CWE-476: NULL Pointer Dereference - CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - Affected Component: (*lxdBackend).CreateCustomVolumeFromBackup in lxd/storage/backend_lxd.go - Attack Vector: Authenticated HTTP POST to /1.0/storage-pools/{pool}/volumes/custom - Required Privileges: can_create_storage_volumes (EntitlementCanCreateStorageVolumes) - Primary Impact: Unhandled SIGSEGV daemon crash (Denial of Service) - Exploit Status: Public Proof-of-Concept (PoC) Available - Patched Versions: LXD 6.9 and LXD 5.21.5 Affected Systems - Canonical LXD - LXD: >= 6.0, < 6.9 (Fixed in: 6.9) - LXD: >= 5.0.0, < 5.21.5 (Fixed in: 5.21.5) Code Analysis Commit: c7cdfad Primary patch on main branch (PR #18320) checking if snapshot.ExpiresAt is non-nil before dereferencing in CreateCustomVolumeFromBackup. --- a/lxd/storage/backend_lxd.go +++ b/lxd/storage/backend_lxd.go @@ -8213,7 +8213,12 @@ func (b *lxdBackend) CreateCustomVolumeFromBackup(ctx context.Context, srcBackup // Validate config and create database entry for new storage volume. // Strip unsupported config keys (in case the export was made from a different type of storage pool). - err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, *snapshot.ExpiresAt, snapVol.ContentType(), true, true) + var snapExpiryDate time.Time + if snapshot.ExpiresAt != nil { + snapExpiryDate = *snapshot.ExpiresAt + } + + err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, snapExpiryDate, snapVol.ContentType(), true, true) if err != nil { return err } Commit: d155208 Backport patch for the LXD 5.21 LTS branch (PR #18390). Commit: 05bc272 Prior fix for CVE-2026-40197 ('Validate snapshots from backup.yaml are non-nil') that left the adjacent *snapshot.ExpiresAt dereference unguarded. Exploit Details - GitHub Security Advisory: Public Proof of Concept (PoC) backup/index.yaml payload and curl reproduction steps published in the official vendor advisory. Mitigation Strategies - Upgrade Canonical LXD to patched releases (6.9+ for the feature branch, 5.21.5+ for the LTS branch). - Restrict the can_create_storage_volumes (EntitlementCanCreateStorageVolumes) permission to fully trusted administrative identities. - Restrict network exposure of the LXD HTTPS REST API (TCP port 8443) to trusted management networks. - Monitor LXD daemon logs for runtime panics and SIGSEGV signals in CreateCustomVolumeFromBackup. Remediation Steps: 1. Identify the currently installed LXD version using 'lxd --version' or 'snap list lxd'. 2. If running LXD 6.0 through 6.8, upgrade to LXD 6.9 or later. 3. If running LXD 5.0.0 through 5.21.4, upgrade to LXD 5.21.5 or later. 4. Audit OpenFGA / RBAC role bindings and local 'lxd' unix group memberships to remove unnecessary volume creation entitlements. References - GitHub Security Advisory GHSA-j93m-3j9p-m5m8 - National Vulnerability Database (NVD) - CVE-2026-9639 - CVE.org Record - CVE-2026-9639 - Canonical LXD Pull Request #18320 (Main Branch Fix) - Canonical LXD Pull Request #18390 (5.21 LTS Backport) - Fix Commit c7cdfadb6044dfeaac592dc225978b4125ee23fe - Backport Commit d15520809e6e2ac2af0c6354dfb7be5854b0e859 - Prior Commit 05bc2729e99707a766d5c4705167a3322c9ef424 (CVE-2026-40197 Fix) - Canonical LXD 6.9 Release Notes - Canonical LXD 5.21.5 Release Notes - CVEListV5 JSON Record for CVE-2026-9639 --- Read the full report for CVE-2026-9639 on our website for more details including interactive diagrams and full exploit analysis.

There is also workshop recently released by canonical that uses lxd under the hood canonical/workshop

GHSA-QX75-2P3R-PWM5: CVE-2026-55622: Cross-Project Instance Copy Authorization Bypass in Canonical LXD and LXC Incus CVE-2026-55622: Cross-Project Instance Copy Authorization Bypass in Canonical LXD and LXC Incus > Vulnerability ID: GHSA-QX75-2P3R-PWM5 > CVSS Score: 7.7 > Published: 2026-11-06 CVE-2026-55622 (GHSA-qx75-2p3r-pwm5) is an improper access control vulnerability (CWE-284) in Canonical LXD and LXC Incus (tracked as GHSA-c9f5-j9c3-mhrg). In multi-tenant deployments utilizing project-based isolation, the REST API handler for instance creation via POST /1.0/instances verifies that the authenticated user has authorization in the destination project specified by the query parameter, but fails to verify whether the user holds read or view permissions for the source instance when executing a copy operation across projects. Consequently, an authenticated client restricted to a single project can clone instances or snapshots from unauthorized projects into their own project, resulting in complete disclosure of the target instance filesystem and embedded credentials. TL;DR A missing authorization check in the instance creation handler (instancesPost) of Canonical LXD and LXC Incus allows an authenticated user with access to at least one project to copy instances and snapshots from any other restricted project on the same daemon or cluster. Once copied into the attacker's authorized project, the attacker gains full administrative control over the duplicate instance and its underlying data. --- ⚠️ Exploit Status: POC Technical Details - CVE / Advisory ID: CVE-2026-55622 / GHSA-qx75-2p3r-pwm5 / GHSA-c9f5-j9c3-mhrg - Weakness Class: CWE-284 (Improper Access Control) - CVSS v3.1 Score: 7.7 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) - EPSS Score: 0.45% (39.55th Percentile) - Attack Vector: Network (Authenticated REST API POST /1.0/instances) - Primary Impact: Cross-Project Instance & Snapshot Cloning / High Confidentiality Loss - Exploit Status: Proof of Concept Publicly Available - CISA KEV Status: Not Listed Affected Systems - Canonical LXD - LXC Incus - LXD (5.0 LTS): >= 4.12.0, < 5.0.7 (Fixed in: 5.0.7) - LXD (5.21 LTS): >= 5.1.0, < 5.21.5 (Fixed in: 5.21.5) - LXD (6.x series): >= 6.0.0, < 6.8.0 (Fixed in: 6.8) - Incus: < 7.2.0 (Fixed in: 7.2.0) Code Analysis Commit: 97cb037 lxd/instances_post: Check EntitlementCanView permission on source instance or snapshot during copy --- a/lxd/instances_post.go +++ b/lxd/instances_post.go @@ -18,6 +18,7 @@ import ( "github.com/canonical/lxd/client" "github.com/canonical/lxd/lxd/archive" + "github.com/canonical/lxd/lxd/auth" "github.com/canonical/lxd/lxd/backup" "github.com/canonical/lxd/lxd/cluster" "github.com/canonical/lxd/lxd/db" @@ -1198,6 +1199,29 @@ func instancesPost(d *Daemon, r *http.Request) response.Response { req.Config = map[string]string{} } + if req.Source.Type == api.SourceTypeCopy { + if req.Source.Source == "" { + return response.BadRequest(errors.New("Must specify a source instance")) + } + + if req.Source.Project == "" { + req.Source.Project = targetProjectName + } + + var sourceURL *api.URL + instanceName, snapshotName, isSnapshot := api.GetParentAndSnapshotName(req.Source.Source) + if isSnapshot { + sourceURL = entity.InstanceSnapshotURL(req.Source.Project, instanceName, snapshotName) + } else { + sourceURL = entity.InstanceURL(req.Source.Project, req.Source.Source) + } + + err = s.Authorizer.CheckPermission(r.Context(), sourceURL, auth.EntitlementCanView) + if err != nil { + return response.SmartError(err) + } + } + if req.InstanceType != "" { conf, err := instanceParseType(req.InstanceType) if err != nil { Commit: bc1e20e lxd/instances_post: Verify UserHasPermission view on source project during copy in LTS branch --- a/lxd/instances_post.go +++ b/lxd/instances_post.go @@ -923,6 +923,20 @@ func instancesPost(d *Daemon, r *http.Request) response.Response { } } + if req.Source.Type == "copy" { + if req.Source.Source == "" { + return response.BadRequest(fmt.Errorf("Must specify a source instance")) + } + + if req.Source.Project == "" { + req.Source.Project = targetProjectName + } + + if !s.Authorizer.UserHasPermission(r, req.Source.Project, "view") { + return response.Forbidden(nil) + } + } + var targetProject *api.Project var profiles []api.Profile var sourceInst *dbCluster.Instance Commit: f784961 lxd/instances_post: Backport source instance EntitlementCanView check to stable release branch Commit: 1e3ffc5 incusd/instances: Check source permission on copy --- a/cmd/incusd/instances_post.go +++ b/cmd/incusd/instances_post.go @@ -1228,6 +1229,20 @@ func instancesPost(d *Daemon, r *http.Request) response.Response { return response.BadRequest(errors.New("Target only allowed when clustered")) } + // For a copy, check that the caller is allowed to view the source instance before any of its details are loaded. + if req.Source.Type == "copy" && req.Source.Source != "" { + sourceProject := req.Source.Project + if sourceProject == "" { + sourceProject = targetProjectName + } + + sourceName, _, _ := api.GetParentAndSnapshotName(req.Source.Source) + err = s.Authorizer.CheckPermission(r.Context(), r, auth.ObjectInstance(sourceProject, sourceName), auth.EntitlementCanView) + if err != nil { + return response.SmartError(err) + } + } + err = s.DB.Cluster.Transaction(r.Context(), func(ctx context.Context, tx *db.ClusterTx) error { dbProject, err := dbCluster.GetProject(ctx, tx.Tx(), targetProjectName) Exploit Details - GitHub Security Advisory (GHSA-qx75-2p3r-pwm5): Official Canonical LXD advisory containing technical reproduction steps and Python proof-of-concept exploit script. - GitHub Security Advisory (GHSA-c9f5-j9c3-mhrg): Official LXC Incus advisory detailing the cross-project instance copy vulnerability. Mitigation Strategies - Upgrade Canonical LXD or LXC Incus packages/snaps to versions containing the source instance authorization check. - Isolate untrusted multi-tenant workloads onto separate physical or virtual LXD/Incus host clusters rather than relying on shared daemon project restrictions. - Restrict network access to the LXD/Incus HTTPS API listener (port 8443) to trusted management networks. - Monitor daemon operation logs for cross-project instance copy operations. Remediation Steps: 1. For Snap-based LXD deployments on the 5.21 LTS track, run: snap refresh lxd --channel=5.21/stable (verify version >= 5.21.5). 2. For Snap-based LXD deployments on the 5.0 LTS track, run: snap refresh lxd --channel=5.0/stable (verify version >= 5.0.7). 3. For Snap-based LXD deployments on the 6.x feature track, run: snap refresh lxd --channel=latest/stable (verify version >= 6.8). 4. For LXC Incus deployments, upgrade the incus package via your distribution package manager to version 7.2.0 or later. 5. Audit existing projects using 'lxc list --all-projects' to verify whether any unauthorized duplicate instances were created in restricted user projects. References - Canonical LXD Security Advisory (GHSA-qx75-2p3r-pwm5) - LXC Incus Security Advisory (GHSA-c9f5-j9c3-mhrg) - National Vulnerability Database (CVE-2026-55622) - CVE.org Record (CVE-2026-55622) - Canonical LXD Fix Commit (97cb037794cb6b21c5a184eb5f3292207adbf6b2) - Canonical LXD LTS Fix Commit (bc1e20ea32dff6ae2df08803eee82832959ec80e) - Canonical LXD Fix Commit (f7849615eb89e71a12ea76daaab6110bdf0fdf7f) - LXC Incus Pull Request #3542 - LXC Incus Fix Commit (1e3ffc53a10950e55de62ac1e0d612be597b84eb) - Incus 7.2 Release Announcement --- Read the full report for GHSA-QX75-2P3R-PWM5 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-7MR3-28H5-M5VX: GHSA-7mr3-28h5-m5vx: Authorization Bypass and Cross-Project Volume Copy in Canonical LXD GHSA-7mr3-28h5-m5vx: Authorization Bypass and Cross-Project Volume Copy in Canonical LXD > Vulnerability ID: GHSA-7MR3-28H5-M5VX > CVSS Score: 7.7 > Published: 2026-11-06 An authorization bypass vulnerability in Canonical LXD (tracked as GHSA-7mr3-28h5-m5vx and CVE-2026-55621, and as GHSA-64f3-v33m-w89f in Linux Containers Incus) allows an authenticated user with restricted project access to copy custom storage volumes and volume snapshots from unauthorized projects. The flaw resides in the storagePoolVolumesPost REST API handler, which verifies permissions on the destination project but fails to check whether the caller holds view entitlements on the source project or volume specified in the request body. TL;DR Authenticated users restricted to a single LXD project can bypass multi-tenant isolation and copy custom storage volumes from any other project by supplying an unauthorized source project name in a volume creation API request. --- ⚠️ Exploit Status: POC Technical Details - Vulnerability ID: GHSA-7mr3-28h5-m5vx / CVE-2026-55621 - Weakness Class: CWE-862 (Missing Authorization) - CVSS v3.1 Score: 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) - Attack Vector: Network (HTTPS REST API on :8443) - Affected Function: storagePoolVolumesPost (lxd/storage_volumes.go) - Security Impact: Cross-project tenant isolation bypass and unauthorized storage volume duplication - Exploit Maturity: Proof of Concept (PoC) Publicly Available - Patched Versions: LXD 5.0.7, 5.21.5, 6.8 Affected Systems - Canonical LXD - Linux Containers Incus - github.com/canonical/lxd - Canonical LXD (5.0 LTS): < 5.0.7 (Fixed in: 5.0.7) - Canonical LXD (5.21 LTS): < 5.21.5 (Fixed in: 5.21.5) - Canonical LXD (6.x): < 6.8 (Fixed in: 6.8) Code Analysis Commit: 8a4ed50 lxd: check for can_view on source when copying volume diff --git a/lxd/storage_volumes.go b/lxd/storage_volumes.go index 95590688d06c..0a3b0b25fbd3 100644 --- a/lxd/storage_volumes.go +++ b/lxd/storage_volumes.go @@ -1067,6 +1067,34 @@ func storagePoolVolumesPost(d *Daemon, r *http.Request) response.Response { return response.BadRequest(fmt.Errorf("Currently not allowed to create storage volumes of type %q", req.Type)) } + if req.Source.Type == api.SourceTypeCopy { + if req.Source.Name == "" { + return response.BadRequest(errors.New("No source volume name supplied")) + } + + if req.Source.Project == "" { + req.Source.Project = requestProjectName + } + + sourceProjectName, err := project.StorageVolumeProject(s.DB.Cluster, req.Source.Project, cluster.StoragePoolVolumeTypeCustom) + if err != nil { + return response.SmartError(err) + } + + var sourceURL *api.URL + sourceVolumeName, snapshotName, isSnapshot := api.GetParentAndSnapshotName(req.Source.Name) + if isSnapshot { + sourceURL = entity.StorageVolumeSnapshotURL(sourceProjectName, req.Source.Location, req.Source.Pool, req.Type, sourceVolumeName, snapshotName) + } else { + sourceURL = entity.StorageVolumeURL(sourceProjectName, req.Source.Location, req.Source.Pool, req.Type, req.Source.Name) + } + + err = s.Authorizer.CheckPermission(r.Context(), sourceURL, auth.EntitlementCanView) + if err != nil { + return response.SmartError(err) + } + } + var poolID int64 var dbVolume *db.StorageVolume Commit: e2635a2 lxd: check for can_view on source when copying volume Commit: eec1cf9 lxd: check for view permission on source project when copying volume diff --git a/lxd/storage_volumes.go b/lxd/storage_volumes.go index cdffd67a4f1f..12b33f1185f2 100644 --- a/lxd/storage_volumes.go +++ b/lxd/storage_volumes.go @@ -657,6 +657,21 @@ func storagePoolVolumesPost(d *Daemon, r *http.Request) response.Response { return response.BadRequest(fmt.Errorf("Currently not allowed to create storage volumes of type %q", req.Type)) } + if req.Source.Type == "copy" { + // Determine the effective source project for the permission check without mutating + // req.Source.Project. The cluster-internal copy path forwards req.Source.Project to the + // source member, where an empty value means "same as the request project". Setting it to an + // explicit value here would make that path treat the copy as a cross-project move and fail. + sourceProject := req.Source.Project + if sourceProject == "" { + sourceProject = requestProjectName + } + + if !s.Authorizer.UserHasPermission(r, sourceProject, "view") { + return response.Forbidden(nil) + } + } + poolID, err := s.DB.Cluster.GetStoragePoolID(poolName) if err != nil { return response.SmartError(err) Exploit Details - GitHub Security Advisory: Official advisory containing reproduction steps and a Python proof-of-concept script demonstrating cross-project custom storage volume duplication. Mitigation Strategies - Upgrade Canonical LXD to patched versions (5.0.7, 5.21.5, or 6.8) that enforce 'view' / 'can_view' entitlement checks on the source project and volume during copy operations. - Restrict network access to the LXD HTTPS REST API endpoint (TCP port 8443) to trusted management networks and administrative hosts. - Audit trusted client certificates and remove unnecessary restricted certificates in multi-tenant environments until patches are applied. - Monitor LXD API access logs and background operation events for cross-project custom storage volume copy requests. Remediation Steps: 1. Identify the currently installed LXD version and channel using 'snap list lxd' or 'lxd --version'. 2. Refresh or upgrade the LXD package to at least 5.0.7 (for 5.0 LTS), 5.21.5 (for 5.21 LTS), or 6.8 (for 6.x feature branch). 3. Verify that the daemon has restarted and is running the updated binary. 4. Audit existing storage volumes across all restricted projects ('lxc storage volume list <pool> --all-projects') to ensure no unauthorized copies of sensitive volumes were created prior to patching. References - LXD Security Advisory (GHSA-7mr3-28h5-m5vx) - Incus Security Advisory (GHSA-64f3-v33m-w89f) - GitHub Advisory Database Entry (GHSA-7mr3-28h5-m5vx) - Fix Commit (8a4ed50ae855639d76021ba4bf26a50d7f2288fd) - Fix Commit (e2635a26957737ec4a77dc28dd7b84bd380881d6) - Fix Commit LTS 5.0.x (eec1cf9504c18ad7c3c36ae0b62d21c05c25702c) - National Vulnerability Database (CVE-2026-55621) - Canonical LXD Upstream Repository --- Read the full report for GHSA-7MR3-28H5-M5VX on our website for more details including interactive diagrams and full exploit analysis.

GHSA-47W9-6R3F-938G: GHSA-47w9-6r3f-938g: Authorization Bypass and Host Root Command Execution in Canonical LXD and Incus GHSA-47w9-6r3f-938g: Authorization Bypass and Host Root Command Execution in Canonical LXD and Incus > Vulnerability ID: GHSA-47W9-6R3F-938G > CVSS Score: 9.9 > Published: 2026-11-06 A missing authorization and configuration validation vulnerability in Canonical LXD and LXC Incus allows authenticated users within restricted projects to bypass project security boundaries. By smuggling prohibited low-level configuration directives (such as raw.lxc or raw.qemu) inside instance snapshots or backup archives, an attacker can restore these configurations within a restricted project and execute arbitrary commands with root privileges on the underlying host operating system. TL;DR Authenticated users in restricted LXD or Incus projects can bypass security restrictions by restoring instance snapshots or importing backups containing prohibited low-level hypervisor hooks (e.g., raw.lxc), leading to arbitrary command execution as root on the host OS. --- ⚠️ Exploit Status: POC Technical Details - Vulnerability ID: GHSA-47w9-6r3f-938g / CVE-2026-48751 - Weakness Class: CWE-862: Missing Authorization - Attack Vector: Network (REST API) - CVSS v3.1 Score: 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - EPSS Score: 0.68% (52.67th Percentile) - Security Impact: Container Escape / Host Root Command Execution - Exploit Status: Public Proof-of-Concept Available - CISA KEV Status: Not Listed Affected Systems - Canonical LXD - LXC Incus - LXD (LTS 4.0 / 5.0 series): >= 4.12.0, < 5.0.7 (Fixed in: 5.0.7) - LXD (LTS 5.21 series): >= 5.1.0, < 5.21.5 (Fixed in: 5.21.5) - LXD (Feature series): >= 6.0.0, < 6.9.0 (Fixed in: 6.9.0) - Incus: < 7.2.0 (Fixed in: 7.2.0) Code Analysis Commit: 5aac658 Validate instance snapshots against project restrictions when importing from backup in lxd/instances_post.go diff --git a/lxd/instances_post.go b/lxd/instances_post.go --- a/lxd/instances_post.go +++ b/lxd/instances_post.go @@ -932,6 +902,56 @@ func createFromBackup(s *state.State, r *http.Request, projectName string, data + // Check restrictions/limits if defined on project. + if restrictions != nil { + err = limits.AllowInstanceCreation(s.GlobalConfig, *restrictions, req) + if err != nil { + return response.SmartError(err) + } + + for i, snapshot := range bInfo.Config.Snapshots { + if snapshot == nil { + return response.SmartError(fmt.Errorf("Nil instance snapshot definition found at index %d", i)) + } + + snapshotReq := api.InstancesPost{ + InstancePut: api.InstancePut{ + Architecture: snapshot.Architecture, + Config: snapshot.Config, + Devices: snapshot.Devices, + Ephemeral: snapshot.Ephemeral, + Profiles: snapshot.Profiles, + Stateful: snapshot.Stateful, + }, + Name: bInfo.Name + "/" + snapshot.Name, + Source: api.InstanceSource{}, + Type: api.InstanceType(bInfo.Config.Instance.Type), + } + + err = limits.AllowInstanceCreation(s.GlobalConfig, *restrictions, snapshotReq) + if err != nil { + return response.SmartError(err) + } + } + } Commit: a52e5d0 Validate snapshot config against project limits and restrictions during snapshot restore in lxd/instance_put.go (master) diff --git a/lxd/instance_put.go b/lxd/instance_put.go --- a/lxd/instance_put.go +++ b/lxd/instance_put.go @@ -235,6 +235,32 @@ func instanceSnapRestore(s *state.State, projectName string, name string, snap s } } + // Build the instance config that restoring the snapshot would apply, so it can be + // validated against the project's restrictions and limits below. + snapProfileNames := make([]string, 0, len(source.Profiles())) + for _, profile := range source.Profiles() { + snapProfileNames = append(snapProfileNames, profile.Name) + } + + snapConfig := api.InstancePut{ + Config: source.LocalConfig(), + Devices: source.LocalDevices().CloneNative(), + Profiles: snapProfileNames, + } + + err = s.DB.Cluster.Transaction(s.ShutdownCtx, func(ctx context.Context, tx *db.ClusterTx) error { + return limits.AllowInstanceUpdate(ctx, s.GlobalConfig, tx, projectName, name, snapConfig, inst.LocalConfig()) + }) + if err != nil { + return err + } + // Generate a new `volatile.uuid.generation` to differentiate this instance restored from a snapshot from the original instance. source.LocalConfig()["volatile.uuid.generation"] = uuid.New().String() Commit: 6b93b2a Backport of snapshot restore project restriction validation to LXD 5.0 branch Commit: cfd9f66 Backport of snapshot restore project restriction validation to LXD 5.21 branch Exploit Details - GitHub Security Advisory: Official advisory containing the proof-of-concept CLI commands to bypass project restrictions via snapshot restoration. - GitHub Security Advisory (Incus): Upstream Incus security advisory detailing the reproduction steps using incus CLI. Mitigation Strategies - Upgrade Canonical LXD or LXC Incus to a patched version that enforces project restriction checks during snapshot restoration and backup ingestion. - Audit all existing instances and snapshots in restricted projects for unauthorized low-level configuration keys such as raw.lxc and raw.qemu. - Restrict untrusted users from migrating instances across projects or importing custom backup tarballs until patches are applied. Remediation Steps: 1. For Canonical LXD 5.0 LTS environments, upgrade the snap or package to version 5.0.7 or later. 2. For Canonical LXD 5.21 LTS environments, upgrade the snap or package to version 5.21.5 or later. 3. For Canonical LXD 6.x environments, upgrade to version 6.9.0 or later. 4. For LXC Incus environments, upgrade the incus package to version 7.2.0 or later. 5. Run an API audit across all restricted projects using 'lxc query /1.0/instances?recursion=2' (or 'incus query') to identify and delete any snapshots or active configurations containing prohibited raw.* directives. References - GitHub Advisory GHSA-47w9-6r3f-938g (Canonical LXD) - GitHub Advisory GHSA-48q5-w887-33wv (LXC Incus) - National Vulnerability Database (NVD) - CVE-2026-48751 - Official CVE.org Record - CVE-2026-48751 - Canonical LXD Fix Commit: Backup Snapshot Validation (5aac658c) - Canonical LXD Fix Commit: Snapshot Restore Validation Master (a52e5d06) - Canonical LXD Fix Commit: Snapshot Restore Validation 5.0 (6b93b2a0) - Canonical LXD Fix Commit: Snapshot Restore Validation 5.21 (cfd9f66f) - Canonical LXD Release 5.0.7 - Canonical LXD Release 5.21.5 --- Read the full report for GHSA-47W9-6R3F-938G on our website for more details including interactive diagrams and full exploit analysis.

GHSA-JPF8-86F3-WP38: CVE-2026-48752: Arbitrary Host File Read and Write via Templates Symlink in Canonical LXD and Incus CVE-2026-48752: Arbitrary Host File Read and Write via Templates Symlink in Canonical LXD and Incus > Vulnerability ID: GHSA-JPF8-86F3-WP38 > CVSS Score: 9.9 > Published: 2026-11-06 A symbolic link traversal vulnerability (CWE-59) in Canonical LXD and Linux Containers Incus allows an authenticated user with image import permissions to read and write arbitrary files on the host filesystem. During image archive unpacking, the daemon fails to reject top-level symbolic links for the instance templates directory. Subsequent requests to the instance template API endpoints follow this symbolic link outside the instance storage directory with root privileges, enabling complete host compromise. TL;DR Authenticated users capable of importing images into LXD or Incus can include a symbolic link at the templates path inside an image tarball. Interacting with the instance template management API causes the root daemon to traverse this symlink onto the host filesystem, granting arbitrary file read and write access as root. --- ⚠️ Exploit Status: POC Technical Details - CVE ID: CVE-2026-48752 - Primary CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following') - CVSS v3.1 Score: 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - Attack Vector: Network / Local UNIX Socket API (Authenticated Image Import) - Security Impact: Arbitrary Host File Read & Write as Root / Container Escape - EPSS Score: 0.78% (56.22nd Percentile) - Exploit Status: Public Proof-of-Concept Available - CISA KEV Status: Not Listed Affected Systems - Canonical LXD - Linux Containers Incus - LXD (4.0 LTS): >= 4.0.0, < 4.0.11 (Fixed in: 4.0.11) - LXD (5.0 LTS): >= 5.0.0, < 5.0.7 (Fixed in: 5.0.7) - LXD (5.x Feature Releases): >= 5.1.0, < 5.21.5 (Fixed in: 5.21.5) - LXD (6.x): >= 6.0.0, < 6.9.0 (Fixed in: 6.9.0) - Incus: < 7.2.0 (Fixed in: 7.2.0) Code Analysis Commit: 190e245 lxd/instance/drivers/common: Prevent rootfs or templates dir to be a symlink diff --git a/lxd/instance/drivers/driver_common.go b/lxd/instance/drivers/driver_common.go index 8bd1c424d81d..eb33a73d2619 100644 --- a/lxd/instance/drivers/driver_common.go +++ b/lxd/instance/drivers/driver_common.go @@ -3,6 +3,7 @@ package drivers import ( "database/sql" "fmt" + "os" "path/filepath" "strconv" "strings" @@ -321,8 +322,9 @@ func (d *common) Path() string { } // RootfsPath returns the instance's rootfs path. -func (d *common) RootfsPath() string { - return filepath.Join(d.Path(), "rootfs") +// Returns an error if the path exists and is a symlink. +func (d *common) RootfsPath() (string, error) { + return d.subPath("rootfs") } // ShmountsPath returns the instance's shared mounts path. @@ -337,8 +339,29 @@ func (d *common) StatePath() string { } // TemplatesPath returns the instance's templates path. -func (d *common) TemplatesPath() string { - return filepath.Join(d.Path(), "templates") +// Returns an error if the path exists and is a symlink. +func (d *common) TemplatesPath() (string, error) { + return d.subPath("templates") +} + +// subPath returns the path of name beneath the instance's path, rejecting it if it exists and is a symlink. +func (d *common) subPath(name string) (string, error) { + path := filepath.Join(d.Path(), name) + + fi, err := os.Lstat(path) + if err != nil { + if os.IsNotExist(err) { + return path, nil + } + + return "", err + } + + if fi.Mode()&os.ModeSymlink != 0 { + return "", fmt.Errorf("%q for instance %q is a symlink", name, d.name) + } + + return path, nil } Commit: 254b85c lxd/instance_metadata: Confine opening of templates Commit: 4cd6334 lxd/instance_metadata: Confine opening of templates Commit: 734fcc4 lxd/instance_metadata: Confine opening of templates Commit: 79f3879 lxd/instance_metadata: Confine opening of templates Commit: cbefa31 incusd/instance: Confine template access to instance root (addresses CVE-2026-48752) Exploit Details - GitHub Security Advisory (Canonical LXD): Official vendor advisory containing the shell script proof-of-concept demonstrating arbitrary host file read and write via /etc/cron.d. - GitHub Security Advisory (Linux Containers Incus): Incus security advisory detailing the templates symlink vulnerability and proof-of-concept reproduction steps. Mitigation Strategies - Upgrade Canonical LXD or Linux Containers Incus to a patched release that enforces directory confinement using os.OpenRoot. - Restrict API access, local UNIX socket group memberships (lxd/incus-admin), and TLS client certificate trust stores to trusted system administrators. - Audit host storage pool directories for existing instances containing symbolic links named 'templates'. - Monitor host file integrity in sensitive directories such as /etc/cron.d, /etc/systemd/system, and /root/.ssh. Remediation Steps: 1. For Linux Containers Incus, upgrade the incus package to version 7.2.0 or later using your distribution package manager. 2. For Canonical LXD, refresh the snap package or upgrade to version 4.0.11, 5.0.7, 5.21.5, or 6.9.0+ depending on the active release channel. 3. Execute find /var/snap/lxd/common/lxd/storage-pools/ -maxdepth 4 -name templates -type l (LXD) or find /var/lib/incus/storage-pools/ -maxdepth 4 -name templates -type l (Incus) to identify any maliciously crafted instances. 4. Review daemon access logs for anomalous GET or POST requests to /1.0/instances/<instance>/metadata/templates. References - GitHub Security Advisory (Canonical LXD): GHSA-jpf8-86f3-wp38 - GitHub Security Advisory (Linux Containers Incus): GHSA-vxp5-584q-c479 - National Vulnerability Database (NVD): CVE-2026-48752 - CVE.org Record: CVE-2026-48752 - Incus 7.2 Release Announcement & Security Advisories - Linux Containers Discussion Forum: Incus 7.2 Release - Incus Patch Commit: cbefa31ae0da8fd96361178aed3a3c631e098fef - LXD Patch Commit: 190e2451544a60f6f924ef50a2112fb65d1923cd - LXD Patch Commit: 254b85c9301397e25304116b63da9154093199da --- Read the full report for GHSA-JPF8-86F3-WP38 on our website for more details including interactive diagrams and full exploit analysis.

なんかこっちのほうが翻訳しましたって出せる感じがして良い(？) なお現在のUbuntu Pro for WSLの翻訳率は58%ほどらしいから興味あったら参加してみよう👍️ github.com/canonical/ubuntu-pro-for-wsl/commit/c9…

Commitはこちらです (やはりWSLの翻訳でした) github.com/canonical/ubuntu-pro-for-wsl/commit/c9…

@YukiharuYABUKI LXDのほうは ubuntu.com からリンクされている github.com/canonical/lxd/security/advisories/GHSA… が404 Not Foundで見れないので詳細は不明です。が、Incus側は salsa.debian.org と github.com/lxc/incus/security/advisories/GHSA-xg7… を見ると、クライアント証明書の検証時に証明書チェーンをきちんと見ていなかったという脆弱性の修正も含まれていますね。

CVE-2026-112816 nvd.nist.gov 該当PR これか lxd#19426 - ピン留め方式の mTLS - サーバは、「先頭の証明書(leaf)」だけ署名検証する - なので、leafだけ信頼一覧と照合する必要があった - でも、クライアントが一緒に送った「leaf以外の未検証の証明書」も照合に使ってた - 先頭にオレオレ証明書、次以降に信頼された証明書をいれとけば攻撃成立する 私のMoQのSDKは自前QUICでTLS1.3相当の処理もある (AI開発) けど、相互認証は入れてなかったや。 仮に入れたら、こういう所は気をつけんとあかんねんな