CVE-2026-97335

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97335
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97335.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97335
Aliases
  • GHSA-p456-92fx-44xh
Downstream
Published
2026-09-28T13:22:19Z
Modified
2026-09-30T03:47:28Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Incorrect authorization in LXD storage volume API allows reading volumes from other projects
Details

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

Database specific 
{
    "cna_assigner":  "canonical",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97335.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "6.0"
                },
                {
                    "fixed":  "6.10"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/canonical/lxd

Affected ranges

Type
GIT
Repo
https://github.com/canonical/lxd
Events
Introduced
1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1
Fixed
6dbdad8c58bbabc680340c61d238255cccece068
Introduced
761d134ceabd306f57acfb0ca51f59b03751a5b0
Fixed
a60b9e26b2e4b8a3353e29d8be45eb623ad16ead
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "5.0.10"
        },
        {
            "introduced":  "5.21.0"
        },
        {
            "fixed":  "5.21.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

lxd-5.*
lxd-5.0.0
lxd-5.0.1
lxd-5.0.2
lxd-5.0.7
lxd-5.0.8
lxd-5.0.9
lxd-5.1
lxd-5.10
lxd-5.11
lxd-5.12
lxd-5.13
lxd-5.14
lxd-5.15
lxd-5.16
lxd-5.17
lxd-5.2
lxd-5.21.5
lxd-5.21.6
lxd-5.21.7
lxd-5.3
lxd-5.4
lxd-5.5
lxd-5.6
lxd-5.7
lxd-5.8
lxd-5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97335.json"