CVE-2026-9640
CVE-2026-9640 · LXD Snapshot Import Privilege Escalation Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.
CVSS 7.2 · High · EPSS 0.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
lxd
- Versions
- ≥ 5.21.0, < 5.21.5: Affected (semver)
- ≥ 5.0.0, < 5.0.7: Affected (semver)
- ≥ 6.0, < 6.9: Affected (semver)
Update to 5.0.7; Update to 5.21.5; Update to 6.9
lxd Debian:12
- Versions
- 5.0.2+git20231211.1364ae4-1
- 5.0.2+git20231211.1364ae4-2
- 5.0.2+git20231211.1364ae4-3
- 5.0.2+git20231211.1364ae4-4
- 5.0.2+git20231211.1364ae4-5
- 5.0.2+git20231211.1364ae4-6
- 5.0.2+git20231211.1364ae4-7
- 5.0.2+git20231211.1364ae4-8
- 5.0.2+git20231211.1364ae4-9
- 5.0.2-5
- 5.0.2-5+deb12u1
- 5.0.2-5+deb12u2
- 5.0.2-5+deb12u3
- 5.0.2-5+deb12u4
- 5.0.2-5+deb12u5
- 5.0.2-5+deb12u6
- 5.0.2-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Debian:13
- Versions
- 5.0.2+git20231211.1364ae4-9
- 5.0.2+git20231211.1364ae4-9+deb13u1
- 5.0.2+git20231211.1364ae4-9+deb13u2
- 5.0.2+git20231211.1364ae4-9+deb13u3
- 5.0.2+git20231211.1364ae4-9+deb13u4
- 5.0.2+git20231211.1364ae4-9+deb13u5
- 5.0.2+git20231211.1364ae4-9+deb13u6
- Affected ranges
- ECOSYSTEM: < 5.0.2+git20231211.1364ae4-9+deb13u7
Update to 5.0.2+git20231211.1364ae4-9+deb13u7