Executive brief
A vulnerability in LXD allows users with limited permissions to bypass security restrictions and gain full administrative control over the entire server cluster. LXD is a system container and virtual machine manager used to run multiple isolated environments on a single server. By exploiting this flaw, an untrusted user (such as a student in a lab or a tenant in a shared hosting environment) can escape their isolated virtual machine and access sensitive data or take over the host system.
Technical details
The 'isVMLowLevelOptionForbidden' function in 'lxd/project/limits/permissions.go' fails to include 'raw.apparmor' and 'raw.qemu.conf' in its forbidden list. This allows a user with 'can_edit' permissions in a restricted project to bypass the 'restricted.virtual-machines.lowlevel=block' security control. An attacker can inject arbitrary AppArmor rules to grant the QEMU process access to the LXD unix socket and use 'raw.qemu.conf' to bridge that socket into the guest VM as a serial device. Once bridged, the attacker can issue administrative API requests from within the VM to elevate their privileges to cluster administrator, leading to a full host escape. Patches are available in interim releases for LXD series 4.0, 5.0, 5.21, and 6.x.
Affected products
- Canonical LXD LXD 4.0, 5.0, 5.21, 6.7
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-10: patched: Interim snap releases published for multiple LTS series.