CVE-2026-34178
CRITICAL9.1EPSS 0.08%LXD: Importing a crafted backup leads to project restriction bypass
發布日:2026/4/10修改日:2026/4/28
描述
In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.
受影響套件(3)
- Debian/incusfrom 0, < 6.0.4-2+deb13u6
- Debian/lxdfrom 0
- Go/github.com/canonical/lxd>= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |