Is CVE-2026-12411 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12411 being exploited in the wild.

How severe is CVE-2026-12411?

High severity, with a CVSS score of 8.4, published 26 June 2026.

Which products and versions are affected?

Canonical LXD >= 6.6, = 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d, SEMVER:introduced=0.0.0-20250721152936-fe86ceb2c3fa,fixed=0.0.0-20260626085133-7cb96ac80a6d.

Is there a fix for CVE-2026-12411?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260626085133-7cb96ac80a6d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12411 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-12411?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12411: Canonical LXD broken access control in devLXDInstancePatchHandler

Q: Is there a fix for CVE-2026-12411?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260626085133-7cb96ac80a6d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-12411 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-12411?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12411 · Severity: high · CVSS 8.4 · Published 2026-06-26

A security vulnerability in Canonical LXD, a system container and virtual machine manager, allows one guest user to access data belonging to another. If a specific management feature is enabled, an untrusted guest can bypass security checks to mount, read, and modify storage volumes that should be private to other guests. This could lead to the theft or corruption of sensitive data in shared hosting or multi-tenant environments.

Technologies: Canonical LXD, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2026-12411 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12411 being exploited in the wild.
How severe is CVE-2026-12411?: High severity, with a CVSS score of 8.4, published 26 June 2026.
Which products and versions are affected?: Canonical LXD >= 6.6, < 6.9; github.com/canonical/lxd (Go) >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d, SEMVER:introduced=0.0.0-20250721152936-fe86ceb2c3fa,fixed=0.0.0-20260626085133-7cb96ac80a6d.
Is there a fix for CVE-2026-12411?: Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260626085133-7cb96ac80a6d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12411 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-12411?: Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/canonical/lxd (Go): upgrade to 0.0.0-20260626085133-7cb96ac80a6d or later
```
go get github.com/canonical/lxd@v0.0.0-20260626085133-7cb96ac80a6d
```

Technical details

A broken access control vulnerability exists in the devLXDInstancePatchHandler component of Canonical LXD when the 'security.devlxd.management.volumes' setting is enabled. While the DevLXD storage API typically enforces ownership checks on GET, PUT, and DELETE requests, the instance device-update path (PATCH) fails to verify volume ownership when attaching a new disk device. An attacker with a local guest identity can submit a crafted device PATCH request over /dev/lxd to attach a custom storage volume belonging to another guest within the same project. This allows the attacker to gain full read and write access to the victim's volume data. The issue is addressed in LXD version 6.9 by ensuring device resource ownership is validated against the caller's identity during the attachment process.

Affected products

Canonical LXD >= 6.6, < 6.9

Identifiers

CVE-2026-12411
GHSA-hhf9-qw4v-72xp
GO-2026-6917

Timeline

2026-06-26: disclosed
2026-06-26: advisory
2026-06-26: patched: Fixed in LXD version 6.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.