# CVE-2026-9640: Canonical LXD privilege escalation via snapshot restoration in restricted projects

Source: https://junglewise.ai/threats/cve-2026-9640-canonical-lxd-privilege-escalation-via-snapshot-restoration-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-9640 · Severity: high · CVSS 7.2 · Published 2026-06-26

A security vulnerability in LXD, a popular container and virtual machine manager, allows users with restricted access to gain full control over the host server. In multi-tenant environments where users are supposed to be isolated, an attacker can bypass security policies by importing a specially crafted backup file containing hidden malicious settings. Once this backup is restored, the attacker can gain root-level access to the entire physical or virtual host, potentially compromising all other data and services on that machine.

Technologies: [Canonical LXD](https://junglewise.ai/threats/technologies/lxd). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-9640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9640 being exploited in the wild.

**How severe is CVE-2026-9640?** High severity, with a CVSS score of 7.2, published 26 June 2026.

**Which products and versions are affected?** Canonical LXD 6.0 before 6.9, 5.21.0 before 5.21.5, 5.0.0 before 5.0.7.

**Is there a fix for CVE-2026-9640?** A patch was published on 2026-05-19: Initial fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9640 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-9640?** Check whether you run Canonical LXD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in LXD's handling of project-restriction policies during snapshot restoration. While LXD enforces security policies (such as blocking 'raw.lxc' or 'security.privileged' keys) on the parent instance during a backup import, it fails to validate these same configuration keys within the snapshot metadata stored in the backup's 'index.yaml'. An authenticated operator in a restricted project can import a crafted backup containing restricted keys in a snapshot; when that snapshot is restored, the 'instanceSnapRestore' handler applies the configuration to the live instance without re-running policy checks. This allows the attacker to bypass 'restricted=true' settings and gain host root access. Patches are available in versions 6.9, 5.21.5, and 5.0.7.

## Affected products

- Canonical LXD 6.0 before 6.9, 5.21.0 before 5.21.5, 5.0.0 before 5.0.7

## Timeline

- 2026-05-19: patched: Initial fix merged into main branch
- 2026-06-26: advisory: GHSA-ppq7-4492-5552 published
- 2026-06-26: disclosed: CVE-2026-9640 published

## References

- [https://github.com/canonical/lxd/pull/18301](https://github.com/canonical/lxd/pull/18301)
- [https://github.com/canonical/lxd/pull/18303](https://github.com/canonical/lxd/pull/18303)
- [https://github.com/canonical/lxd/pull/18304](https://github.com/canonical/lxd/pull/18304)
- [https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552](https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552)

## Related threats

- [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0)
- [Canonical LXD improper certificate validation in HTTPS listener](https://junglewise.ai/threats/cve-2026-112816-improper-certificate-validation-in-the-https-listener-in)
- [Canonical LXD custom storage volume authorization bypass](https://junglewise.ai/threats/cve-2026-97335-incorrect-authorization-in-the-custom-storage-volume-creation)
- [Canonical LXD arbitrary file write via symlink in migration stream](https://junglewise.ai/threats/cve-2026-87799-improper-link-resolution-in-the-migration-receive-path-in)
- [Canonical LXD improper symlink resolution in recursive file pull](https://junglewise.ai/threats/cve-2026-87798-improper-link-resolution-in-the-recursive-file-pull-feature-of)