Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
High, CVSS 8.4amended

lxd allows Cross-guest volume hijack via DevLXD device patch

CVE-2026-12411GHSA-hhf9-qw4v-72xp

What to do

Vendor fix available. Upgrade each affected package to the fixed version on its release line (github.com/canonical/lxd 0.0.0-20260626085133-7cb96ac80a6d), redeploy, then verify what is actually installed.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

  • Go github.com/canonical/lxd

    Affected
    >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d
    Fixed in
    0.0.0-20260626085133-7cb96ac80a6d

Sources

Severity and exploitation
Exploitation
No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.
CVSS
8.4 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS
  • CVE-2026-12411: 0.24% estimated exploitation activity in the next 30 days; percentile 14.68 (FIRST EPSS, 2026-11-10). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

Summary A guest can mount another guest's custom storage volume over `/dev/lxd` and read or write its contents without owning it. The DevLXD storage API blocks access to volumes you don't own, but the instance device-update path that attaches a volume to a container without checks ownership. Any guest in a project with `security.devlxd.management.volumes` enabled can attach a volume belonging to a different guest by naming it in a device `PATCH`, giving one tenant full read and write access to another tenant's volume data.

Details Volumes created over DevLXD get `volatile.devlxd.owner` set to the calling identity. The storage handlers enforce it on `GET`/`PUT`/`DELETE` (`isDevLXDVolumeOwner`, lxd/devlxd_storage.go:359) and on volume-copy sources…

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 3 · amended ·

    Amended from osv record GO-2026-6917

  2. Revision 2 · amended ·

    Amended from osv record GHSA-hhf9-qw4v-72xp

  3. Revision 1 · created ·

    Published from ghsa record GHSA-hhf9-qw4v-72xp

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-12411

Advisory: lxd allows Cross-guest volume hijack via DevLXD device patch
IDs: CVE-2026-12411, GHSA-hhf9-qw4v-72xp
Record: https://patchnext.com/advisories/cve-2026-12411 (revision 3, source checked 6 Nov 2026, 06:15 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/canonical/lxd 0.0.0-20260626085133-7cb96ac80a6d. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/canonical/lxd: affected >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d; fixed in 0.0.0-20260626085133-7cb96ac80a6d

## Suggested inspection (read-only)
- Go github.com/canonical/lxd: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/canonical/lxd.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-hhf9-qw4v-72xp (GitHub-reviewed advisory GHSA-hhf9-qw4v-72xp lists affected ranges: Go github.com/canonical/lxd >=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d)
- Verified: https://osv.dev/vulnerability/GHSA-hhf9-qw4v-72xp (OSV record GHSA-hhf9-qw4v-72xp lists affected ranges: Go github.com/canonical/lxd >=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d (fixed))
- Verified: https://osv.dev/vulnerability/GO-2026-6917 (OSV record GO-2026-6917 lists affected ranges: Go github.com/canonical/lxd >=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d (fixed))

Commands are suggestions: review each one before running it.

Loading voting…