CVE-2026-9640: LXD Snapshot Import Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 5.21.5 - Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 5.0.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9640?
CVE-2026-9640 has a severity rating of 7.2, which is classified as high.
How do I fix CVE-2026-9640?
To mitigate CVE-2026-9640, upgrade LXD to version 6.9 or later, or to version 5.21.5 or later for the affected 5.21.0 series.
Who is affected by CVE-2026-9640?
Authenticated project operators in restricted multi-tenant environments using vulnerable LXD versions are at risk from CVE-2026-9640.
What type of vulnerability is CVE-2026-9640?
CVE-2026-9640 is a privilege escalation vulnerability related to snapshot restoration in LXD.
What does CVE-2026-9640 allow an attacker to do?
CVE-2026-9640 allows an authenticated user to bypass project-restriction policies during snapshot restoration.