CVE-2026-9640

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9640", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-05-26T18:31:24.593Z", "datePublished": "2026-06-26T15:50:38.453Z", "dateUpdated": "2026-06-30T03:55:24.628Z"}, "containers": {"cna": {"title": "LXD Snapshot Import Privilege Escalation Vulnerability", "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "5.21.0", "status": "affected", "versionType": "semver", "lessThan": "5.21.5"}, {"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.7"}, {"version": "6.0", "status": "affected", "versionType": "semver", "lessThan": "6.9"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863: Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552", "tags": ["vdb-entry", "vendor-advisory"]}, {"url": "https://github.com/canonical/lxd/pull/18301", "tags": ["patch"]}, {"url": "https://github.com/canonical/lxd/pull/18303", "tags": ["patch"]}, {"url": "https://github.com/canonical/lxd/pull/18304", "tags": ["patch"]}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153: Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 6.9 or later, 5.21.5 or later, or 5.0.7 or later."}], "credits": [{"lang": "en", "type": "finder", "value": "Miha Purg"}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-06-26T15:50:38.453Z"}}, "adp": [{"references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-9640"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T03:55:24.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9640", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-26T15:59:50.952818Z"}}}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T16:00:17.949Z"}}], "cna": {"title": "LXD Snapshot Import Privilege Escalation Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Miha Purg"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153: Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "5.21.0", "lessThan": "5.21.5", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.7", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.9", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to LXD version 6.9 or later, 5.21.5 or later, or 5.0.7 or later."}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552", "tags": ["vdb-entry", "vendor-advisory"]}, {"url": "https://github.com/canonical/lxd/pull/18301", "tags": ["patch"]}, {"url": "https://github.com/canonical/lxd/pull/18303", "tags": ["patch"]}, {"url": "https://github.com/canonical/lxd/pull/18304", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-06-26T15:50:38.453Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9640", "state": "PUBLISHED", "dateUpdated": "2026-06-30T03:55:24.628Z", "dateReserved": "2026-05-26T18:31:24.593Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-06-26T15:50:38.453Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "LXD", "platforms": ["Linux"], "product": "LXD", "repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "versions": [{"lessThan": "5.21.5", "status": "affected", "version": "5.21.0", "versionType": "semver"}, {"lessThan": "5.0.7", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "6.9", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "847C5578-B73F-45BA-8E6E-C9F69B7E3254", "versionEndExcluding": "5.0.7", "versionStartIncluding": "4.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "BBD4ACC0-A547-4D52-B4E7-AD7ACD9D6081", "versionEndExcluding": "5.21.5", "versionStartIncluding": "5.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "C25E18E8-CDDF-4F3A-A80E-F27456981A4B", "versionEndExcluding": "6.9", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios existe en LXD desde 6.0 antes de 6.9, 5.21.0 antes de 5.21.5 y 5.0.0 antes de 5.0.7 con respecto al manejo de las pol\u00edticas de restricci\u00f3n de proyectos durante la restauraci\u00f3n de instant\u00e1neas. Un operador de proyecto autenticado en un entorno multiinquilino restringido puede eludir las restricciones de la pol\u00edtica importando una copia de seguridad de instancia creada maliciosamente que contiene claves de configuraci\u00f3n restringidas dentro de una instant\u00e1nea. Cuando se restaura la instant\u00e1nea, estas claves restringidas se aplican a la instancia en vivo sin validaci\u00f3n de pol\u00edtica. Iniciar la instancia modificada otorga al operador acceso root de host no autorizado."}], "id": "CVE-2026-9640", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9640", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-26T16:16:37.250", "references": [{"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/canonical/lxd/pull/18301"}, {"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/canonical/lxd/pull/18303"}, {"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/canonical/lxd/pull/18304"}, {"source": "security@ubuntu.com", "tags": ["Exploit"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.21.0,5.21.5)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.7)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LXD", "source": "cna", "vendor": "Canonical"}, "product": "lxd", "vendor": "canonical"}], "created": "2026-06-26T17:45:03.935676+00:00", "updated": "2026-06-26T23:30:05.804611+00:00", "vendors": ["canonical", "canonical$PRODUCT$lxd"]}