CVE-2026-34178

OVERVIEW CVE-2026-34178 affects Canonical LXD versions prior to 6.8 and involves a critical validation bypass in the backup import functionality. The vulnerability exists because the import process validates project restrictions against one file (backup/index.yaml) while actually creating instances from a different, unchecked file (backup/container/backup.yaml) within the same archive. This dual-file discrepancy allows attackers to bypass intended security controls. SEVERITY The vulnerability carries a CVSS score of 9.1 (Critical) with a network-based attack vector requiring low complexity and high privileges but no user interaction. The attack has a significant scope change, enabling complete system compromise through unauthorized host access. An authenticated remote attacker with instance-creation permissions in a restricted project can craft malicious backup archives containing restricted settings such as security.privileged=true or raw.lxc directives, completely circumventing project restriction enforcement and achieving full host compromise. EXPLOITATION STATUS Currently, there is no evidence of active exploitation, as indicated by its inactive status on threat tracking lists and absence from the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.0005 indicates minimal probability of exploitation in the wild. However, the theoretical severity remains high given that exploitation requires only authenticated access with standard instance-creation permissions, making it a significant concern for organizations running vulnerable LXD versions with multi-project deployments.