PT-2026-31596 · Canonical+1 · Lxd+1

Miha Purg · Published 2026-04-09 · Updated 2026-05-13 · CVE-2026-34178

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canonical LXD versions prior to 6.8

Description Canonical LXD versions prior to 6.8 have an issue where the backup import path validates project restrictions against backup/index.yaml within a supplied tar archive, but instance creation is based on backup/container/backup.yaml, which is not subject to the same project restrictions. This allows an authenticated remote attacker with instance creation permissions in a restricted project to bypass project restrictions by crafting a malicious backup archive where backup.yaml contains restricted settings, such as security.privileged=true or raw.lxc directives, potentially leading to full host compromise.

Recommendations Update to version 6.8 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-34178

GHSA-Q96J-3FMM-7FV4

Affected Products

Lxd

Red Os

References · 18

• 🔥 https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4 · Exploit
• https://github.com/canonical/lxd/pull/17921 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34178 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34178 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-34178 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34178 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q96j-3fmm-7fv4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34178 · Security Note
• https://github.com/canonical/lxd · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-lxd-cve-2026-34178-7.3 · Note
• https://twitter.com/CveFindCom/status/2042199025483497868 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042187257734398344 · Twitter Post
• https://twitter.com/CVEarity/status/2042563269538517263 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-lxd-cve-2026-34178-8.0 · Note