CVE-2026-34177 - Vulnerability Analysis

Overview

Canonical LXD 4.12 through 6.7 contains a broken access control vulnerability caused by an incomplete denylist in isVMLowLevelOptionForbidden, letting remote attackers with can_edit permission on a VM instance escalate privileges to LXD cluster administrator and host root, exploit requires can_edit permission on VM instance in restricted project.

Severity & Score

Impact

Attackers with VM edit permission can escalate privileges to cluster admin and host root, compromising the entire system.

Mitigation

Update to a version later than 6.7 or the latest available version.

References

• https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f
• https://github.com/canonical/lxd/pull/17909

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner