CVE-2026-12411: falha de alta gravidade em Canonical lxd
Broken Access Control in Canonical LXD DevLXD API
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.3%
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
Canonical · lxdCVEs relacionadas — Canonical lxd
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28384CRITICALAuthenticated RCE via unsanitized compression_algorithmEPSS 0.7%CVE-2026-34178CRITICALImporting a crafted backup leads to project restriction bypassEPSS 0.4%CVE-2026-34177CRITICALVM lowlevel restriction bypass via raw.apparmor and raw.qemu.confEPSS 0.4%CVE-2026-28385MEDIUMSSRF via image import from URL allows internal network probing by authenticated usersEPSS 0.3%CVE-2026-34179CRITICALUpdate of type field in restricted TLS certificate allows privilege escalation to cluster adminEPSS 0.3%CVE-2026-3351LOWAuthorization Bypass in LXD GET /1.0/certificates EndpointEPSS 0.2%