PT-2026-31595 · Canonical+1 · Lxd+1

Miha Purg · Published 2026-04-09 · Updated 2026-05-13 · CVE-2026-34177

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.7

Description Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in the isVMLowLevelOptionForbidden function (lxd/project/limits/permissions.go). This denylist omits raw.apparmor and raw.qemu.conf from the keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration. This allows bridging the LXD Unix socket into the guest VM, potentially leading to privilege escalation to LXD cluster administrator and subsequently to host root.

Recommendations Update to a version beyond 6.7. As a temporary workaround, restrict can edit permissions on VM instances within restricted projects.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

BDU:2026-07537

CVE-2026-34177

GHSA-FM2X-C5QW-4H6F

Affected Products

Lxd

Red Os

References · 22

• 🔥 https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f · Exploit
• https://github.com/canonical/lxd/pull/17909 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-34177 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34177 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34177 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07537 · Security Note
• https://osv.dev/vulnerability/GHSA-fm2x-c5qw-4h6f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34177 · Security Note
• https://github.com/canonical/lxd · Note
• https://twitter.com/pulsepatchio/status/2043164593703239690 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-lxd-cve-2026-34177-8.0 · Note
• https://twitter.com/0dayPublishing/status/2042220867778736539 · Twitter Post
• https://twitter.com/CveFindCom/status/2042198982290485603 · Twitter Post