CVE-2026-12411
Received Received - Intake
Broken Access Control in Canonical LXD via devLXDInstancePatchHandler

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Canonical Ltd.

Description
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-12411
EUVD
EUVD-2026-39788
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
canonical lxd 6.9
canonical lxd From 6.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-12411 is a broken access control vulnerability in the devLXDInstancePatchHandler component of Canonical LXD. It allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume by sending a crafted device PATCH request over /dev/lxd when the security.devlxd.management.volumes setting is enabled.

The issue occurs because the device-attach path in LXD does not verify ownership when attaching a volume to a container, enabling a guest to attach volumes belonging to other guests and gain unauthorized access.

Impact Analysis

This vulnerability can lead to broken access control across tenants in a multi-guest environment, allowing an attacker to hijack another guest's custom storage volume.

  • An attacker can mount, read, and overwrite data in another guest's storage volume.
  • Unauthorized data access and modification can occur, potentially leading to data breaches or data loss.

The attack complexity is low, no user interaction is required, and the vulnerability has a high CVSS score of 8.4, indicating a serious security risk.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Canonical LXD installation to version 6.9 or later, where the patch addressing this issue has been applied.

Additionally, consider disabling the feature security.devlxd.management.volumes if it is not required, as the vulnerability exploits this setting.

Ensure proper access controls and ownership checks are enforced on device updates and volume attachments to prevent unauthorized access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12411. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart