CVE-2026-97335
Deferred Deferred - Pending Action

Incorrect Authorization in Canonical LXD Storage Volume Creation

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Canonical Ltd.

Description
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-97335
EUVD
EUVD-2026-88259

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
canonical lxd to 6.9-bf243da (inc)
canonical lxd From 5.0.0 (inc)
canonical lxd 5.0.10
canonical lxd 5.21.8
canonical lxd 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Canonical LXD allows an authenticated user with volume creation permissions in a project to copy and read any custom storage volume from other projects, including snapshots and configurations. The issue occurs when creating a volume with a source volume but without specifying the source type, bypassing access checks.

Detection Guidance

To detect this vulnerability, check LXD server logs for suspicious custom volume creation requests that omit the source.type parameter. Look for requests with source.volume and source.project set but no source.type. Use commands like 'lxc query /1.0/logs' to review logs or 'lxc query /1.0/storage-pools' to inspect storage volumes for unexpected copies.

Impact Analysis

An attacker with limited access could exploit this to read sensitive data from other projects, violating data isolation. This could lead to unauthorized access to confidential information, such as configurations or snapshots, without needing elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating principles of data protection and confidentiality required by GDPR and HIPAA. It undermines project isolation, potentially exposing personal or sensitive data to unauthorized users.

Mitigation Strategies

Immediately upgrade LXD to a patched version (5.0.10, 5.21.8, 6.9-bf243da, or 6.10). If upgrading is not possible, restrict network access to LXD API endpoints and audit all custom volume creation requests. Disable project-based volume sharing until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart