{"id":"GO-2026-6917","revision":"d605326d83fa4a33b8743901bcbd0ecc","records":[{"revision":"d605326d83fa4a33b8743901bcbd0ecc","observedAt":"2026-11-06T00:38:11.447+00:00","statement":{"source":"osv","id":"GO-2026-6917","aliases":["CVE-2026-12411","GHSA-hhf9-qw4v-72xp"],"title":"LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd","description":"LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd","state":0,"publishedAt":"2026-11-05T23:49:57+00:00","modifiedAt":"2026-11-06T00:15:13.1007081+00:00","affected":[{"ecosystem":"Go","name":"github.com/canonical/lxd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-20250721152936-fe86ceb2c3fa"},{"kind":"fixed","version":"0.0.0-20260626085133-7cb96ac80a6d"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp","https://github.com/canonical/lxd/commit/752e25cfb849a349ff08939ce02747ef4d4e69cc","https://github.com/canonical/lxd/commit/7cb96ac80a6d52a96b53b0ae06a8659606fa8dd8","https://github.com/canonical/lxd/pull/18585"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6917","license":"OSV · upstream source license applies","key":"osv:GO-2026-6917","identifiers":["GO-2026-6917","CVE-2026-12411","GHSA-hhf9-qw4v-72xp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}