CVE-2026-12411 ยท GHSA-hhf9-qw4v-72xp
lxd allows Cross-guest volume hijack via DevLXD device patch
- Risk score
- 72/100
- CVSS
- 9.6 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 26 Jun 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request. This could enable an attacker to access sensitive data or disrupt the system.
- Affected
- {'product': 'lxd', 'package': 'github.com/canonical/lxd', 'version': '>= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d'}
- Fix
- Upgrade to version 0.0.0-20260626085133-7cb96ac80a6d or later
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 9.6 critical
- Public exploit or proof of concept referenced
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/canonical/lxd | go | >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d | 0.0.0-20260626085133-7cb96ac80a6d |
References
- https://github.com/advisories/GHSA-hhf9-qw4v-72xp
- https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp
- https://nvd.nist.gov/vuln/detail/CVE-2026-12411
- https://github.com/canonical/lxd/pull/18585
- https://github.com/canonical/lxd/commit/752e25cfb849a349ff08939ce02747ef4d4e69cc
- https://github.com/advisories/GHSA-hhf9-qw4v-72xp
Original description
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Last activity 5 Nov 2026. Patch Forecast updates every hour.