CVE-2026-12411

Katalog CVE

CVSS 9.6 · Critical EPSS 0,29%

Kerentanan Authorization Bypass Through User-Controlled Key pada canonical lxd. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

2 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp exploit · advisory vendor
• https://github.com/canonical/lxd/pull/18585 issue tracking · patch