Canonical LXD up to 5.0.9/5.21.7/6.9 Custom Storage Volume Creation Endpoint source.volume/source.project/source.type privileges management

Summaryinfo

A vulnerability identified as problematic has been detected in Canonical LXD up to 5.0.9/5.21.7/6.9. This issue affects some unknown processing of the component Custom Storage Volume Creation Endpoint. Performing a manipulation of the argument source.volume/source.project/source.type results in privileges management. This vulnerability was named CVE-2026-97335. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Canonical LXD up to 5.0.9/5.21.7/6.9. It has been classified as problematic. This affects some unknown functionality of the component Custom Storage Volume Creation Endpoint. The manipulation of the argument source.volume/source.project/source.type with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. The summary by CVE is:

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-97335 since 09/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 5.0.10, 5.21.8 or 6.10 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Canonical

Name

• LXD

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.21.0
• 5.21.1
• 5.21.2
• 5.21.3
• 5.21.4
• 5.21.5
• 5.21.6
• 5.21.7
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9

License

• open-source

Website

• Product: https://github.com/canonical/lxd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion