CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions…
- Risk score
- 48/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the…
- Affected
- See advisory
- Fix
- Upgrade the product to 5.0.10, 5.21.8 or 6.10 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
Original description
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.
Last activity 28 Sep 2026. Patch Forecast updates every hour.