CVE-2026-34177 Details
Description
Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root.
A vulnerability in Canonical LXD versions 4.12 through 6.7 allows for privilege escalation from a restricted project user to host root. The issue arises from an incomplete denylist in the 'isVMLowLevelOptionForbidden' function, which fails to block 'raw.apparmor' and 'raw.qemu.conf' under the 'restricted.virtual-machines.lowlevel=block' project restriction. A remote attacker with 'can_edit' permission on a VM instance can exploit this omission by injecting AppArmor rules and QEMU configurations that bridge the LXD Unix socket into the guest VM. This exploitation grants the attacker full administrative access to the LXD cluster, which can be leveraged to gain root access on the host.
Users can upgrade to LXD versions 5.0.7, 5.21.5, 6.8, or 4.0.10 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f | CISA-ADP | Third Party Advisory |
| https://github.com/canonical/lxd/pull/17909 | [email protected] | Issue Tracking |
| https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| canonical lxd | >= 4.12, <= 5.0.6 >= 5.21.0, <= 5.21.4 >= 6.0, <= 6.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | New CVE Received | [email protected] |