{"id":"CVE-2026-34177","sourceIdentifier":"security@ubuntu.com","published":"2026-04-09T10:16:21.653","lastModified":"2026-06-17T10:38:36.340","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root."}],"affected":[{"source":"security@ubuntu.com","affectedData":[{"vendor":"Canonical","product":"lxd","defaultStatus":"unaffected","collectionURL":"https://github.com/canonical","packageName":"lxd","platforms":["Linux"],"programFiles":["permissions.go"],"repo":"https://github.com/canonical/lxd","versions":[{"version":"4.12.0","lessThan":"5.0.7","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.21.5","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@ubuntu.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-09T12:12:43.482752Z","id":"CVE-2026-34177","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@ubuntu.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndIncluding":"5.0.6","matchCriteriaId":"41A5CC7C-00BE-436D-957A-4636E52D0DF1"},{"vulnerable":true,"criteria":"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","versionStartIncluding":"5.21.0","versionEndIncluding":"5.21.4","matchCriteriaId":"92A82DF4-3ED9-47E0-BDF1-DB9138EE0883"},{"vulnerable":true,"criteria":"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndIncluding":"6.7","matchCriteriaId":"5C28FC63-0BE4-4B40-A87F-DF242AE33303"}]}]}],"references":[{"url":"https://github.com/canonical/lxd/pull/17909","source":"security@ubuntu.com","tags":["Issue Tracking"]},{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f","source":"security@ubuntu.com","tags":["Third Party Advisory"]},{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"]}]}