Is CVE-2026-34178 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34178 being exploited in the wild.

How severe is CVE-2026-34178?

Critical severity, with a CVSS score of 9.1, published 9 April 2026.

Which products and versions are affected?

Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, = 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267, SEMVER:introduced=0.0.0-20210305023314-538ac3df036e, SEMVER:introduced=0.0.0-20210305023314-538ac3df036e,last_affected=0.0.0-20260226085519-736f34afb267.

Is there a fix for CVE-2026-34178?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34178 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-34178?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34178: Canonical LXD project restriction bypass via crafted backup import

Q: Is there a fix for CVE-2026-34178?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-34178 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-34178?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34178 · Severity: critical · CVSS 9.1 · Published 2026-04-09

LXD is a system container and virtual machine manager used to run isolated environments on Linux. A vulnerability in how LXD imports backup files allows a user with limited permissions to bypass security restrictions and gain full administrative control over the host server. By providing a specially crafted backup file, an attacker can create a container that has unauthorized access to the host's files and resources, potentially leading to a complete system takeover.

Technologies: Canonical LXD, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2026-34178 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34178 being exploited in the wild.
How severe is CVE-2026-34178?: Critical severity, with a CVSS score of 9.1, published 9 April 2026.
Which products and versions are affected?: Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267; github.com/canonical/lxd (Go) >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267, SEMVER:introduced=0.0.0-20210305023314-538ac3df036e, SEMVER:introduced=0.0.0-20210305023314-538ac3df036e,last_affected=0.0.0-20260226085519-736f34afb267.
Is there a fix for CVE-2026-34178?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34178 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-34178?: Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability arises from a discrepancy between two configuration files within a backup tar archive: 'backup/index.yaml' and 'backup/container/backup.yaml'. LXD's 'AllowInstanceCreation' function validates project restrictions (such as blocking privileged containers or host device passthrough) against 'index.yaml'. However, the actual instance is created using the configuration in 'backup.yaml', which is not re-validated against project-specific restrictions. An attacker with instance-creation rights in a restricted project can craft a backup where 'index.yaml' appears benign while 'backup.yaml' contains malicious configurations like 'security.privileged=true' or 'raw.lxc' host mounts. This allows for container escape and full host compromise. Patches are available in LXD series 5.0, 5.21, and 6.

Affected products

Canonical LXD >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267

Identifiers

CVE-2026-34178
GHSA-q96j-3fmm-7fv4
GO-2026-5576

Timeline

2026-04-09: advisory: Initial GitHub Advisory published
2026-04-10: disclosed: Full advisory details and CVE-2026-34178 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.