CVE-2026-9640: canonical lxd Incorrect Authorization
Vulnerability summary
CVE-2026-9640 is a high (CVSS 7.2) Incorrect Authorization vulnerability in canonical lxd. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 26-06-2026PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLxd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- lxd≥ 5.0.0, < 5.0.7 | ≥ 4.12, < 5.0.7 | ≥ 5.21.0, < 5.21.5 | ≥ 6.0, < 6.9
Debian1 product
- lxdAll versions (No fix recorded) | < 5.0.2+git20231211.1364ae4-9+deb13u7
2 vendors · 2 products
