Lxd
Vendor:
First CVE: Jun 9, 2016 · Active for 10 years
24
Total CVEs
More Total CVEs than 96% of tracked products
4.8
Avg CVEs / Year
Higher CVE frequency than 89% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 39% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Lxd over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 9, 2016
10 years ago
Most Recent CVE
Jun 26, 2026
32 days ago
CVE Severity & Scoring
Lxd24 CVEs
8%
54%
17%
21%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local6 (25.0%)
Network18 (75.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low23 (95.8%)
High1 (4.2%)
Unknown0 (0.0%)
User Interaction
None22 (91.7%)
Unknown0 (0.0%)
Required2 (8.3%)
Privileges Required
Low13 (54.2%)
High7 (29.2%)
None4 (16.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (24 CVEs).
24 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-12411CRITICAL Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via | Jun 26, 2026 | 9.6 | 38 | NO | NO |
CVE-2026-34179CRITICAL In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certif | Apr 9, 2026 | 9.1 | 32 | NO | NO |
CVE-2026-34177CRITICAL Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.con | Apr 9, 2026 | 9.1 | 32 | NO | NO |
CVE-2026-28384CRITICAL An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server | Mar 12, 2026 | 9.4 | 32 | NO | NO |
CVE-2026-34178CRITICAL In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/contai | Apr 9, 2026 | 9.1 | 31 | NO | NO |
CVE-2026-9640HIGH A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during s | Jun 26, 2026 | 7.2 | 29 | NO | NO |
CVE-2026-9639MEDIUM Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause | Jun 26, 2026 | 6.5 | 27 | NO | NO |
CVE-2025-54286HIGH Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HT | Oct 2, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-54289HIGH Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrar | Oct 2, 2025 | 8.1 | 26 | NO | NO |
CVE-2026-28385MEDIUM In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_imag | Jun 26, 2026 | 5.0 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (24 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (24 CVEs).
Media Mentions
Signals from CVEs in this product scope (24 CVEs).
Top CNAs Publishing CVEs For Lxd
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.6 | 1 | 4.3 | 0.1% | 0 | 0 |
| 5.21 | 1 | 6.7 | 0.3% | 0 | 0 |
| 5.0 | 1 | 6.7 | 0.3% | 0 | 0 |
| 2.0.1 | 1 | 5.5 | 0.4% | 0 | 0 |