CVE-2026-9640

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9640

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9640.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9640

Aliases

GHSA-ppq7-4492-5552

Downstream

DEBIAN-CVE-2026-9640

Published

2026-06-26T15:50:38.453Z

Modified

2026-07-09T04:00:42.860057080Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

LXD Snapshot Import Privilege Escalation Vulnerability

Details

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9640.json",
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/canonical/lxd

Affected ranges

Type

GIT

Repo

https://github.com/canonical/lxd

Events

Introduced

fb8480e2fec971a5edcdfd43c0b861355be90f1d

Fixed

7b1f0b6acefa288398ead8dda48b046d7b2795a3

Introduced

13192d6c1abbfcc9da53ce4c8451abb6da3f5f65

Fixed

28f4061af24739ae06b678c53f155c6c02357c92

Introduced

Fixed

0dc5080834a2cde19536a849c56931f6acb067f7

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.12"
        },
        {
            "fixed": "5.0.7"
        },
        {
            "introduced": "5.21.0"
        },
        {
            "fixed": "5.21.5"
        },
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.9"
        }
    ]
}

Affected versions

lxd-0.*

lxd-0.1

lxd-0.10

lxd-0.11

lxd-0.12

lxd-0.13

lxd-0.14

lxd-0.15

lxd-0.16

lxd-0.17

lxd-0.18

lxd-0.19

lxd-0.2

lxd-0.20

lxd-0.21

lxd-0.22

lxd-0.23

lxd-0.24

lxd-0.25

lxd-0.26

lxd-0.27

lxd-0.3

lxd-0.4

lxd-0.5

lxd-0.6

lxd-0.7

lxd-0.8

lxd-0.8.1

lxd-0.9

lxd-2.*

lxd-2.0.0

lxd-2.0.0.beta1

lxd-2.0.0.beta2

lxd-2.0.0.beta3

lxd-2.0.0.beta4

lxd-2.0.0.rc1

lxd-2.0.0.rc2

lxd-2.0.0.rc3

lxd-2.0.0.rc4

lxd-2.0.0.rc5

lxd-2.0.0.rc6

lxd-2.0.0.rc7

lxd-2.0.0.rc8

lxd-2.0.0.rc9

lxd-2.1

lxd-2.10

lxd-2.10.1

lxd-2.11

lxd-2.12

lxd-2.13

lxd-2.14

lxd-2.15

lxd-2.16

lxd-2.17

lxd-2.18

lxd-2.19

lxd-2.2

lxd-2.20

lxd-2.21

lxd-2.3

lxd-2.4

lxd-2.4.1

lxd-2.5

lxd-2.6

lxd-2.6.1

lxd-2.6.2

lxd-2.7

lxd-2.8

lxd-2.9

lxd-2.9.1

lxd-2.9.2

lxd-2.9.3

lxd-3.*

lxd-3.0.0

lxd-3.0.0.beta1

lxd-3.0.0.beta2

lxd-3.0.0.beta3

lxd-3.0.0.beta4

lxd-3.0.0.beta5

lxd-3.0.0.beta6

lxd-3.0.0.beta7

lxd-3.1

lxd-3.10

lxd-3.11

lxd-3.12

lxd-3.13

lxd-3.14

lxd-3.15

lxd-3.16

lxd-3.17

lxd-3.18

lxd-3.19

lxd-3.2

lxd-3.20

lxd-3.21

lxd-3.22

lxd-3.23

lxd-3.3

lxd-3.4

lxd-3.5

lxd-3.6

lxd-3.7

lxd-3.8

lxd-3.9

lxd-4.*

lxd-4.0.0

lxd-4.1

lxd-4.10

lxd-4.11

lxd-4.12

lxd-4.13

lxd-4.14

lxd-4.15

lxd-4.16

lxd-4.17

lxd-4.18

lxd-4.19

lxd-4.2

lxd-4.20

lxd-4.21

lxd-4.22

lxd-4.23

lxd-4.24

lxd-4.3

lxd-4.4

lxd-4.5

lxd-4.6

lxd-4.7

lxd-4.8

lxd-4.9

lxd-5.*

lxd-5.0.0

lxd-5.0.1

lxd-5.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9640.json"