CVE-2026-12411

Analyzed Analyzed - Analysis Complete

Broken Access Control in Canonical LXD via devLXDInstancePatchHandler

Publication date: 2026-06-26

Last updated on: 2026-07-02

Assigner: Canonical Ltd.

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-07-02

Generated

2026-07-16

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-15

NVD

CVE-2026-12411

EUVD

EUVD-2026-39788

Affected Vendors & Products

Vendor	Product	Version / Range
canonical	lxd	From 6.6 (inc) to 6.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-12411 is a broken access control vulnerability in the devLXDInstancePatchHandler component of Canonical LXD. It allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume by sending a crafted device PATCH request over /dev/lxd when the security.devlxd.management.volumes setting is enabled.

The issue occurs because the device-attach path in LXD does not verify ownership when attaching a volume to a container, enabling a guest to attach volumes belonging to other guests and gain unauthorized access.

Impact Analysis

This vulnerability can lead to broken access control across tenants in a multi-guest environment, allowing an attacker to hijack another guest's custom storage volume.

An attacker can mount, read, and overwrite data in another guest's storage volume.
Unauthorized data access and modification can occur, potentially leading to data breaches or data loss.

The attack complexity is low, no user interaction is required, and the vulnerability has a high CVSS score of 8.4, indicating a serious security risk.

Compliance Impact

The vulnerability allows unauthorized access and modification of another guest's custom storage volume, leading to broken access control and potential data breaches.

Such unauthorized data access and modification can result in violations of data protection regulations like GDPR and HIPAA, which require strict controls on data confidentiality, integrity, and access.

Because the vulnerability enables a guest to bypass ownership checks and access sensitive data of other tenants, it poses a significant risk to compliance with these standards that mandate proper authorization and data isolation.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Canonical LXD installation to version 6.9 or later, where the patch addressing this issue has been applied.

Additionally, consider disabling the feature security.devlxd.management.volumes if it is not required, as the vulnerability exploits this setting.

Ensure proper access controls and ownership checks are enforced on device updates and volume attachments to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-12411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70