CVE-2026-12411

High

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

SeverityHigh

CVSS8.4

Exploit probability—

ProductCanonical Lxd

PublishedJun 26, 2026

First seenJun 26, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key CWE-862Missing authorization

How to fix

Update

canonical lxd6.9 or later
github.com/canonical/lxd0.0.0-20260626085133-7cb96ac80a6d or later

Patches

github.com/canonical/lxd/pull/18585

Vendor advisories

github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp

Affected products

Product	Affected versions	Fixed in
canonical lxd	6.6 ≤ v < 6.9	6.9
github.com/canonical/lxdGo	0.0.0-20250721152936-fe86ceb2c3fa ≤ v < 0.0.0-20260626085133-7cb96ac80a6d	0.0.0-20260626085133-7cb96ac80a6d

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.