CVE-2026-12411

CriticalCVSS 9.6/10Last modified Oct 25, 2026

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-639 CWE-862

Affected software

Vendor	Product	Versions
Canonical	lxd	>= 6.6, < 6.9

References

https://github.com/canonical/lxd/pull/18585Issue Tracking, Patch
https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xpExploit, Vendor Advisory
https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xpExploit, Vendor Advisory

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-124137.5An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of CVE-2026-124159.8The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edi CVE-2026-124169.8The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0.CVE-2026-124179.8The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeov CVE-2026-1241707.5Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241748.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241768.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241786.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-1241796.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-124185.3The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable t CVE-2026-1241836.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-1241857.5Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.