CVE-2026-12411: Canonical LXD: Broken Access Control (IDOR) in devLXD Instance PATCH Handler

Overview

CVE-2026-12411 is classified as CWE-639 (authorization bypass through a user-controlled key, commonly called IDOR). The flaw is in the devLXDInstancePatchHandler component of Canonical LXD. The record describes it as an untrusted guest being able to act on another guest's custom storage volume through the devLXD interface. The vendor advisory is published on GitHub Security Advisories, and a patch is referenced in pull request 18585.

Impact

According to the record, the attack can allow a guest to mount, read and overwrite another guest's custom storage volume. The record notes this applies only when the setting security.devlxd.management.volumes is enabled. The NVD vector indicates high confidentiality and integrity impact with no availability impact and a scope change.

Confidentiality: data on the other guest's custom volume may be read.
Integrity: data on that volume may be overwritten.
Availability: not indicated by the NVD vector.

Affected products and versions

The record lists Canonical LXD versions greater than or equal to 6.6 and less than 6.9 as affected. No fixed version is stated in the record. The patch is referenced in pull request 18585, and the upper bound of the affected range suggests the fix is in a release at or after 6.9, but this must be confirmed in the vendor advisory.

Exploitation status

The CISA KEV catalog does not list this CVE, so the record does not confirm active exploitation. No confirmed exploitation appears in the sources consulted. The GHSA reference carries an 'Exploit' tag in the record, but the record does not describe specific exploitation activity. The EPSS probability is 0.00288 with a percentile of 0.19814, dated 2026-10-13.

Remediation and mitigation

Identify all Canonical LXD hosts running a version in the affected range.
Apply the vendor patch or upgrade to a release that the GHSA advisory identifies as fixed.
Where the devLXD volume management feature is not required, consider leaving security.devlxd.management.volumes disabled. This is an inference from the record, which states the flaw requires that setting to be enabled.
Review which guests share hosts with sensitive custom storage volumes, since the risk depends on cross-guest access.

Detection guidance

Inventory LXD versions and list hosts that have the affected setting enabled.
Review LXD and host logs for unexpected storage volume mount, read or modification activity originating from guests.
Check changes to custom storage volumes for ownership or configuration that does not match expected guest activity.

Limitations of the available information

The record does not state a fixed version, a vendor-published exploitation status, or a full technical description of the vulnerable code path, and these details are not included here. The NVD score of 9.6 and the Ubuntu CNA score of 8.4 differ, and the record does not explain the difference. The record also does not state whether the fix is in a specific backport branch.

Frequently asked questions

What is CVE-2026-12411?

It is a broken access control flaw in the devLXDInstancePatchHandler component of Canonical LXD. The record says an untrusted guest can mount, read and overwrite another guest's custom storage volume when a specific setting is enabled.

Which Canonical LXD versions are affected?

The record lists versions greater than or equal to 6.6 and less than 6.9. It does not state the fixed version, so check the GHSA advisory for the release that contains the fix.

Is this CVE being actively exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.