High severity8.4NVD Advisory· Published Jun 26, 2026· Updated Jul 2, 2026

CVE-2026-12411

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Affected products

Canonical/Lxd2 versions
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*range: >=6.6,<6.9
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/canonical/lxd/pull/18585nvdIssue TrackingPatch
github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xpnvdExploitVendor Advisory
github.com/advisories/GHSA-hhf9-qw4v-72xpghsaADVISORY
github.com/canonical/lxd/commit/752e25cfb849a349ff08939ce02747ef4d4e69ccghsa
nvd.nist.gov/vuln/detail/CVE-2026-12411ghsa

News mentions

No linked articles in our index yet.

cvss	0.546
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000