CVE-2026-12411: Broken Access Control in Canonical LXD DevLXD API

Q: What is the severity of CVE-2026-12411?

The severity of CVE-2026-12411 is rated as high with a score of 8.4.

Q: How do I fix CVE-2026-12411?

To mitigate CVE-2026-12411, disable the security.devlxd.management.volumes setting in Canonical LXD.

Q: What does CVE-2026-12411 affect?

CVE-2026-12411 affects the devLXDInstancePatchHandler component of Canonical LXD.

Q: What can an attacker do with CVE-2026-12411?

An attacker can mount, read, and overwrite another guest's custom storage volume through a crafted device PATCH request.

Q: When was CVE-2026-12411 published?

CVE-2026-12411 was published on June 26, 2026.

Published Jun 26, 2026

Updated

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Affected Software

2 affected components

Canonical LXD (devLXD API)

Canonical LXD>=6.6<6.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade canonical/lxd to a version that resolves this vulnerability.
Fixed in 6.9

Event History

Jun 26, 2026

CVE Published

via MITRE·03:27 PM

Data Sourced

via MITRE·03:27 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-12411?

The severity of CVE-2026-12411 is rated as high with a score of 8.4.

How do I fix CVE-2026-12411?

To mitigate CVE-2026-12411, disable the security.devlxd.management.volumes setting in Canonical LXD.

What does CVE-2026-12411 affect?

CVE-2026-12411 affects the devLXDInstancePatchHandler component of Canonical LXD.

What can an attacker do with CVE-2026-12411?