{"id":"CVE-2026-34178","sourceIdentifier":"security@ubuntu.com","published":"2026-04-09T10:16:21.820","lastModified":"2026-06-17T10:38:36.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise."}],"affected":[{"source":"security@ubuntu.com","affectedData":[{"vendor":"Canonical","product":"lxd","defaultStatus":"unaffected","collectionURL":"https://github.com/canonical","packageName":"lxd","platforms":["Linux"],"programFiles":["permissions.go"],"repo":"https://github.com/canonical/lxd","versions":[{"version":"4.12.0","lessThan":"5.0.7","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.21.5","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@ubuntu.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-09T11:54:57.626476Z","id":"CVE-2026-34178","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@ubuntu.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndIncluding":"5.0.6","matchCriteriaId":"41A5CC7C-00BE-436D-957A-4636E52D0DF1"},{"vulnerable":true,"criteria":"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","versionStartIncluding":"5.21.0","versionEndIncluding":"5.21.4","matchCriteriaId":"92A82DF4-3ED9-47E0-BDF1-DB9138EE0883"},{"vulnerable":true,"criteria":"cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndIncluding":"6.7","matchCriteriaId":"5C28FC63-0BE4-4B40-A87F-DF242AE33303"}]}]}],"references":[{"url":"https://github.com/canonical/lxd/pull/17921","source":"security@ubuntu.com","tags":["Issue Tracking"]},{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","source":"security@ubuntu.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}