{"id":"EUVD-2026-20874","enisaUuid":"f391ec5a-3a0d-3398-9638-39bb3872e717","description":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged\u003dtrue or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.","datePublished":"Apr 9, 2026, 9:18:58 AM","dateUpdated":"Apr 9, 2026, 11:55:20 AM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4\nhttps://github.com/canonical/lxd/pull/17921\n","aliases":"CVE-2026-34178\nGHSA-q96j-3fmm-7fv4\n","assigner":"canonical","epss":0.42,"enisaIdProduct":[{"id":"1d4b344f-59c6-324e-a3bb-c2f591208689","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"6.0.0 \u003c6.8.0"},{"id":"1ff0d959-5730-38df-ad97-bb821b3f3d23","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"5.1.0 \u003c5.21.5"},{"id":"f16ae4c4-1cf7-3897-9846-617ce9ec1c2e","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"4.12.0 \u003c5.0.7"}],"enisaIdVendor":[{"id":"f0ad43a8-7411-3210-9193-2f9f507171ac","vendor":{"name":"Canonical"}}],"enisaIdVulnerability":[{"id":"147319e5-d716-3fd2-8c48-7c89069a41fd","vulnerability":{"id":"CVE-2026-34178","description":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged\u003dtrue or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.","datePublished":"Apr 9, 2026, 9:18:58 AM","dateUpdated":"Apr 9, 2026, 11:55:20 AM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4\nhttps://github.com/canonical/lxd/pull/17921\n","enisa_id":"EUVD-2026-20874\n","assigner":"canonical","epss":0.42,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"0d4b26fc-e658-3109-9d41-3365d1f90bc2","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"4.12.0 \u003c5.0.7"},{"id":"4a4df4ce-fefb-3fd2-af14-bfea352a79ba","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"5.1.0 \u003c5.21.5"},{"id":"fee88f15-df5a-305d-8e70-2c505795f1cd","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"6.0.0 \u003c6.8.0"}],"vulnerabilityVendor":[{"id":"56a61f74-9103-32fb-be22-5dbe26c84a84","vendor":{"name":"Canonical"}}]}},{"id":"99a4f7f8-5122-3703-b8cc-82cbdbaa6f75","vulnerability":{"id":"GHSA-q96j-3fmm-7fv4","description":"LXD: Importing a crafted backup leads to project restriction bypass","datePublished":"Apr 10, 2026, 7:20:55 PM","dateUpdated":"Apr 10, 2026, 7:20:55 PM","baseScore":0.0,"references":"https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34178\nhttps://github.com/canonical/lxd/pull/17921\nhttps://github.com/canonical/lxd\n","enisa_id":"EUVD-2026-20874\n","aliases":"GHSA-q96j-3fmm-7fv4\nCVE-2026-34178\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}