CVE-2026-9640

LXD Snapshot Import Privilege Escalation Vulnerability

State: Published
Severity: 7.2 High
Published: Jun 26, 2026
Updated: Jun 30, 2026
Reserved: May 26, 2026

Description

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	canonical

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
LXDCanonical	5.21.0 to before 5.21.5Affected 5.0.0 to before 5.0.7Affected 6.0 to before 6.9Affected

References

https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552vdb-entryvendor-advisory
https://github.com/canonical/lxd/pull/18301patch
https://github.com/canonical/lxd/pull/18303patch
https://github.com/canonical/lxd/pull/18304patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.