CVE 2026 34177

nvd.nist.gov • April 13, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Privilege Escalation Vulnerabilities in Canonical LXD Discovered Three critical vulnerabilities (CVE-2026-34177, CVE-2026-34178, CVE-2026-34179) have been identified in Canonical LXD versions 4.12 through 6.7, allowing authenticated users to escalate privileges to cluster admin and host root. CVE-2026-34177 involves an incomplete denylist that lets attackers inject AppArmor rules and QEMU configurations, compromising the host. CVE-2026-34178 allows attackers to bypass project restrictions by manipulating configuration files during backup creation. CVE-2026-34179 enables a restricted TLS certificate user to gain admin privileges by altering their certificate type. The vulnerabilities impact availability, confidentiality, and integrity of systems using LXD. Organizations are urged to prioritize patching and enhance monitoring capabilities. The vulnerabilities were published on April 9, 2026, and pose a significant risk to affected systems. Immediate action is recommended to mitigate potential exploitation. 2 sources 73

Extracted Entities

CVE 2026 34177

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (3)