{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34177", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-03-26T09:24:08.448Z", "datePublished": "2026-04-09T09:15:27.532Z", "dateUpdated": "2026-04-09T12:12:48.251Z"}, "containers": {"cna": {"title": "VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf", "affected": [{"vendor": "Canonical", "product": "lxd", "platforms": ["Linux"], "collectionURL": "https://github.com/canonical", "packageName": "lxd", "repo": "https://github.com/canonical/lxd", "programFiles": ["permissions.go"], "versions": [{"status": "affected", "version": "4.12.0", "lessThan": "5.0.7", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.21.5", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-184", "description": "CWE-184 Incomplete list of disallowed inputs", "type": "CWE"}]}], "descriptions": [{"lang": "en", "value": "Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root."}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f", "name": "VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf", "tags": ["vdb-entry", "vendor-advisory"]}, {"url": "https://github.com/canonical/lxd/pull/17909", "name": "lxd: Prevent use of raw.apparmor and raw.qemu.conf when low level options are blocked", "tags": ["patch", "issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Miha Purg", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-09T09:15:27.532Z"}}, "adp": [{"references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T12:12:43.482752Z", "id": "CVE-2026-34177", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T12:12:48.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34177", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T12:12:43.482752Z"}}}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T12:12:35.998Z"}}], "cna": {"title": "VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Miha Purg"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "lxd", "versions": [{"status": "affected", "version": "4.12.0", "lessThan": "5.0.7", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.21.5", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.8.0", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "lxd", "programFiles": ["permissions.go"], "collectionURL": "https://github.com/canonical", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f", "name": "VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf", "tags": ["vdb-entry", "vendor-advisory"]}, {"url": "https://github.com/canonical/lxd/pull/17909", "name": "lxd: Prevent use of raw.apparmor and raw.qemu.conf when low level options are blocked", "tags": ["patch", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184 Incomplete list of disallowed inputs"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-09T09:15:27.532Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34177", "state": "PUBLISHED", "dateUpdated": "2026-04-09T12:12:48.251Z", "dateReserved": "2026-03-26T09:24:08.448Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-04-09T09:15:27.532Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "41A5CC7C-00BE-436D-957A-4636E52D0DF1", "versionEndIncluding": "5.0.6", "versionStartIncluding": "4.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "92A82DF4-3ED9-47E0-BDF1-DB9138EE0883", "versionEndIncluding": "5.21.4", "versionStartIncluding": "5.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C28FC63-0BE4-4B40-A87F-DF242AE33303", "versionEndIncluding": "6.7", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root."}], "id": "CVE-2026-34177", "lastModified": "2026-04-22T20:57:22.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2026-04-09T10:16:21.653", "references": [{"source": "security@ubuntu.com", "tags": ["Issue Tracking"], "url": "https://github.com/canonical/lxd/pull/17909"}, {"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-fm2x-c5qw-4h6f"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[4.12.0,5.0.7)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.1.0,5.21.5)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lxd", "source": "cna", "vendor": "Canonical"}, "product": "lxd", "vendor": "canonical"}], "analysis": {"en": {"generated_at": "2026-04-09T10:20:57.686769+00:00", "value": {"mitigation_remediation": ["Upgrade Canonical LXD to a version that includes the denylist fix (>=6.8).", "Remove any raw.apparmor or raw.qemu.conf settings from VM configurations in restricted projects as a temporary workaround."], "summary": {"action": "Patch Now", "impact": "Remote Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Canonical LXD versions 4.12 through 6.7 are impacted. Users running any of these releases should assess whether their environments use the restricted.virtual-machines.lowlevel=block project constraint and grant can_edit permissions on virtual machines.", "description_and_impact": "Canonical LXD includes an incomplete denylist that fails to block raw.apparmor and raw.qemu.conf options when the restricted.virtual-machines.lowlevel=block setting is enabled. An attacker who can edit a virtual machine in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that forwards the LXD Unix socket into the guest, giving the attacker escalation power to the cluster administrator and ultimately host root. This weakness corresponds to CWE-184 and directly permits privilege escalation beyond the intended project boundaries.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.1, indicating critical severity. While an EPSS score is not available, the high CVSS and lack of mitigation in affected releases suggest a strong likelihood of exploitation. A remote attacker only requires write permission on a VM within a restricted project to exploit the flaw, then can remotely inject configuration changes that give cluster administrator and finally host root access. The vulnerability is not listed in CISA\u2019s KEV catalog, but the impact remains considerable for any system exposed to this misconfiguration."}}}}, "created": "2026-04-10T08:53:53.516323+00:00", "updated": "2026-04-10T09:33:03.650288+00:00", "vendors": ["canonical", "canonical$PRODUCT$lxd"]}