Executive brief
A security vulnerability in LXD, a popular container and virtual machine manager, allows users with restricted access to gain full control over the host server. In multi-tenant environments where users are supposed to be isolated, an attacker can bypass security policies by importing a specially crafted backup file containing hidden malicious settings. Once this backup is restored, the attacker can gain root-level access to the entire physical or virtual host, potentially compromising all other data and services on that machine.
Technical details
A privilege escalation vulnerability exists in LXD's handling of project-restriction policies during snapshot restoration. While LXD enforces security policies (such as blocking 'raw.lxc' or 'security.privileged' keys) on the parent instance during a backup import, it fails to validate these same configuration keys within the snapshot metadata stored in the backup's 'index.yaml'. An authenticated operator in a restricted project can import a crafted backup containing restricted keys in a snapshot; when that snapshot is restored, the 'instanceSnapRestore' handler applies the configuration to the live instance without re-running policy checks. This allows the attacker to bypass 'restricted=true' settings and gain host root access. Patches are available in versions 6.9, 5.21.5, and 5.0.7.
Affected products
- Canonical LXD 6.0 before 6.9, 5.21.0 before 5.21.5, 5.0.0 before 5.0.7
Timeline
- 2026-05-19: patched: Initial fix merged into main branch
- 2026-06-26: advisory: GHSA-ppq7-4492-5552 published
- 2026-06-26: disclosed: CVE-2026-9640 published