LXD
- Software type
- Virtualization platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, LXD recorded 9 security vulnerabilities in the last 90 days, of which 6 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of LXD and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-112816Improper certificate validation in the HTTPS listener in LXDCVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projectsCVE-2026-87799Arbitrary file write on LXD host via symlink in migration streamCVE-2026-87798LXD client recursive file pull allows directory escape via malicious VM agentCVE-2026-86335LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-112816Improper certificate validation in the HTTPS listener in LXD | Exploitation statusNot exploited | FixYes |
| SeverityCritical |
CVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projects | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-87799Arbitrary file write on LXD host via symlink in migration stream | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-87798LXD client recursive file pull allows directory escape via malicious VM agent | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-86335LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-86334CLI Path Traversal via Content-Disposition in LXD Image Export/Copy | Exploitation statusActively exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-85526Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD | Exploitation statusActively exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-85185Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root | Exploitation statusActively exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-66897Instance template path traversal allows arbitrary host file write as root | Exploitation statusNot exploited | FixYes | Published08/24/2026 | SeverityCritical |
|---|
CVE-2026-66898Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-63300Cross-project instance move bypasses all project restrictions allowing host command execution | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-63299Storage volume cross-project move and snapshot restore bypass project disk limits | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-63298LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-63297Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-63296Project restriction bypass via instance migration config override | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-63295Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-63294Root RCE via image backup.yaml symlink | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-63293Arbitrary host file read and write in Canonical LXD via metadata.yaml symlink | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-62420Cross-project cluster migration bypasses project restrictions via cluster notification flag | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityCritical |
|---|
CVE-2026-16033Arbitrary file read+write on host via templates/ symlink in malicious image | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-9640LXD Snapshot Import Privilege Escalation Vulnerability | Exploitation statusActively exploited | FixYes | Published06/26/2026 | SeverityHigh |
|---|
CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXD | Exploitation statusActively exploited | FixYes | Published06/26/2026 | SeverityMedium |
|---|
CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated users | Exploitation statusNot exploited | FixYes | Published06/26/2026 | SeverityMedium |
|---|
CVE-2026-12411Broken Access Control in Canonical LXD DevLXD API | Exploitation statusActively exploited | FixYes | Published06/26/2026 | SeverityHigh |
|---|
CVE-2026-34179Update of type field in restricted TLS certificate allows privilege escalation to cluster admin | Exploitation statusActively exploited | FixYes | Published04/09/2026 | SeverityCritical |
|---|
CVE-2026-34178Importing a crafted backup leads to project restriction bypass | Exploitation statusActively exploited | FixYes | Published04/09/2026 | SeverityCritical |
|---|
CVE-2026-34177VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf | Exploitation statusActively exploited | FixYes | Published04/09/2026 | SeverityCritical |
|---|
CVE-2026-28384Authenticated RCE via unsanitized compression_algorithm | Exploitation statusActively exploited | FixYes | Published03/12/2026 | SeverityCritical |
|---|
CVE-2026-3351Authorization Bypass in LXD GET /1.0/certificates Endpoint | Exploitation statusNot exploited | FixYes | Published03/03/2026 | SeverityLow |
|---|
CVE-2025-54293Path Traversal in LXD Instance Log File Retrieval | Exploitation statusActively exploited | FixYes | Published10/02/2025 | SeverityHigh |
|---|
CVE-2025-54292Client-Side Path Traversal in LXD-UI | Exploitation statusActively exploited | FixYes | Published10/02/2025 | SeverityMedium |
|---|
CVE-2025-54291Project existence disclosure in LXD images API | Exploitation statusActively exploited | FixYes | Published10/02/2025 | SeverityMedium |
|---|
CVE-2025-54290Project Existence Disclosure via Error Handling in LXD Image Export | Exploitation statusActively exploited | FixYes | Published10/02/2025 | SeverityMedium |
|---|
CVE-2025-54289Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API | Exploitation statusNot exploited | FixYes | Published10/02/2025 | SeverityHigh |
|---|
CVE-2025-54288Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server | Exploitation statusActively exploited | FixYes | Published10/02/2025 | SeverityMedium |
|---|
CVE-2025-54287Arbitrary File Read via Template Injection in Snapshot Patterns | Exploitation statusActively exploited | FixYes | Published10/02/2025 | SeverityHigh |
|---|
CVE-2025-54286CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI | Exploitation statusNot exploited | FixYes | Published10/02/2025 | SeverityHigh |
|---|
37 Results | Page 1 of 1