COOEY // HUBcompliance · community · intelligence

Exposures › CVE-2026-12411

CVE-2026-12411

Severity
high
Source
NVD · cve
Published
2026-06-26
CVSS
8.4
Reference
https://nvd.nist.gov/vuln/detail/CVE-2026-12411
shame 25/100

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Players implicated

canonical · vendorlxd · product

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Affected FedRAMP products 0 in the catalog

No correlated FedRAMP products.