{"id":"CVE-2026-34178","revision":"28fd0c330a034cfb862f57fc2962f5d7","records":[{"revision":"28fd0c330a034cfb862f57fc2962f5d7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-34178","aliases":[],"title":"Importing a crafted backup leads to project restriction bypass","description":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.","state":0,"publishedAt":"2026-04-09T09:18:58.404+00:00","modifiedAt":"2026-04-09T11:55:20.431+00:00","affected":[{"ecosystem":"https://github.com/canonical","name":"lxd","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Canonical\",\n                    \"product\": \"lxd\",\n                    \"platforms\": [\n                        \"Linux\"\n                    ],\n                    \"collectionURL\": \"https://github.com/canonical\",\n                    \"packageName\": \"lxd\",\n                    \"repo\": \"https://github.com/canonical/lxd\",\n                    \"programFiles\": [\n                        \"permissions.go\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.12.0\",\n                            \"lessThan\": \"5.0.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.1.0\",\n                            \"lessThan\": \"5.21.5\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0.0\",\n                            \"lessThan\": \"6.8.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","https://github.com/canonical/lxd/pull/17921"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34178","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-34178","identifiers":["CVE-2026-34178"]},"retained":false,"historicalAffected":[]}],"coverage":[]}