CVE-2026-12411: Canonical LXD Auth Bypass Vulnerability

CVE-2026-12411 Overview

CVE-2026-12411 is a broken access control vulnerability [CWE-639] in the devLXDInstancePatchHandler component of Canonical LXD. An untrusted guest instance can mount, read, and overwrite another guest's custom storage volume by sending a crafted device PATCH request over the /dev/lxd socket. Exploitation requires that the security.devlxd.management.volumes setting is enabled on the host. The flaw breaks the tenant isolation boundary that LXD is designed to enforce, exposing data belonging to co-located workloads on the same host.

Critical Impact
A low-privileged guest can attach and modify custom storage volumes belonging to other guests on the same LXD host, resulting in cross-tenant data disclosure and tampering.

Affected Products

Canonical LXD (versions prior to the fix in PR #18585)
LXD deployments with security.devlxd.management.volumes enabled
Multi-tenant LXD hosts serving untrusted guest instances

Discovery Timeline

2026-06-26 - CVE-2026-12411 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-12411

Vulnerability Analysis

The vulnerability resides in the devLXDInstancePatchHandler function, which processes device modification requests submitted by guest instances through the /dev/lxd management socket. When security.devlxd.management.volumes is enabled, guests may modify their own device configuration. The handler fails to verify that the storage volume referenced in a PATCH request belongs to the requesting guest.

A guest instance sends a crafted PATCH request identifying a custom storage volume owned by a different tenant. LXD accepts the reference and attaches the volume to the attacker-controlled instance. Once mounted, the attacker has read and write access to the target volume's file system contents. The scope-changing nature of the flaw means the impact crosses the guest security boundary and affects resources owned by the host-level storage subsystem.

Root Cause

The root cause is a missing ownership check between the authenticated guest identity and the target storage volume resource. The handler trusts the volume identifier supplied by the guest without confirming that the volume is associated with the calling instance's project or profile. This is a textbook Authorization Bypass Through User-Controlled Key [CWE-639] pattern.

Attack Vector

Exploitation is performed from inside a guest instance with access to the /dev/lxd socket. The attacker crafts a device PATCH request naming a custom storage volume belonging to another instance and submits it through the local devLXD API. Refer to the GitHub Security Advisory GHSA-hhf9-qw4v-72xp for full technical details.

Detection Methods for CVE-2026-12411

Indicators of Compromise

Unexpected PATCH requests to the devLXD socket referencing custom storage volume identifiers not owned by the calling instance.
LXD audit log entries showing device attachments where the volume project or owning instance differs from the requesting guest.
New mount points inside guest instances mapping to storage volumes belonging to other tenants.

Detection Strategies

Enable LXD audit and API request logging, then alert on devlxd PATCH operations that modify devices with type=disk and a source referencing a foreign volume.
Correlate LXD daemon events with host-level block device or mount activity to surface unauthorized attachments.
Baseline expected devLXD API traffic per instance and flag deviations, particularly volume references outside the guest's project scope.

Monitoring Recommendations

Forward LXD daemon logs (/var/log/lxd/) and systemd journal entries for lxd.service to a central log platform for retention and analysis.
Monitor the state of security.devlxd.management.volumes across all hosts and alert when it is enabled on multi-tenant systems.
Track custom storage volume attachment inventories and diff against a known-good baseline on a scheduled interval.

How to Mitigate CVE-2026-12411

Immediate Actions Required

Upgrade Canonical LXD to a version containing the fix from PR #18585.
Disable security.devlxd.management.volumes on all hosts until the patch is applied, especially on multi-tenant deployments.
Audit existing guests for unauthorized device attachments referencing custom storage volumes.

Patch Information

Canonical addressed the flaw in the upstream LXD repository through PR #18585, which adds the missing authorization check in devLXDInstancePatchHandler. See GHSA-hhf9-qw4v-72xp for the vendor advisory and affected versions.

Workarounds

Set security.devlxd.management.volumes=false on every instance and profile as a temporary control.
Restrict devLXD API exposure by disabling guest management of devices where operationally feasible.
Segregate untrusted guests onto dedicated hosts and storage pools to limit blast radius until patching completes.

bash

# Configuration example: disable devLXD volume management per instance
lxc config set <instance-name> security.devlxd.management.volumes false

# Apply the same setting to a profile used by untrusted guests
lxc profile set default security.devlxd.management.volumes false

# Verify the setting across all running instances
for i in $(lxc list -c n --format csv); do
  echo "== $i =="
  lxc config get "$i" security.devlxd.management.volumes
done