HIGH 8.4 GitHub
CVE-2026-12411
lxd allows Cross-guest volume hijack via DevLXD device patch
### Summary
A guest can mount another guest's custom storage volume over `/dev/lxd` and read or write its contents without owning it. The DevLXD storage API blocks access to volumes you don't own, but the instance device-update path that attaches a volume to a container without checks ownership. Any guest in a project with `security.devlxd.management.volumes` enabled can attach a volume belonging to a different guest by naming it in a device `PATCH`, giving one tenant full read and write access
Affected Products
- go/github.com/canonical/lxd >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d
References
- https://github.com/advisories/GHSA-hhf9-qw4v-72xp
- https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp
- https://nvd.nist.gov/vuln/detail/CVE-2026-12411
- https://github.com/canonical/lxd/pull/18585
This high severity vulnerability with a CVSS score of 8.4 was published on 2026-11-05 via GitHub. Affected: go/github.com/canonical/lxd >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.