Unrated severityNVD Advisory· Published Jun 28, 2026
Debian lxd: Broken Access Control in the devLXDInstancePatchHandler component of Canonical L…
CVE-2026-12411
Description
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.