CVE-2026-12411 — Broken Access Control in Canonical LXD DevLXD API
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume …
Published: 2026-06-26 · CVSS: 8.4 · CVSS 3.1
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7