CVE-2026-9640: LXD Privilege Escalation via Snapshot Policy Bypass in Multi-Tenant Environments

Technical summary

The vulnerability stems from insufficient policy validation during snapshot restoration in LXD's project-restriction framework. When a project operator restores a snapshot from a backup, the system fails to re-validate restricted configuration keys that are embedded within the snapshot metadata. In a properly restricted multi-tenant environment, certain host-level configuration keys should be immutable and blocked from modification by project-scoped operators. However, this validation is bypassed during the snapshot restore operation, allowing an operator to inject prohibited keys into the instance configuration. Upon instance startup, these keys take effect without further policy checks, resulting in unauthorized access escalation to the host's root account. The root cause is inadequate input sanitization and policy enforcement in the snapshot restoration code path, classified as an authorization flaw (CWE-863).

Business impact

In multi-tenant LXD deployments used for containerized workloads, hosting, or cloud platforms, this vulnerability enables a compromised or malicious operator account to escape tenant isolation and compromise the entire host system. This breaks the fundamental trust boundary in shared infrastructure environments. An attacker gaining host root access can pivot to other tenant instances, exfiltrate sensitive data, modify billing systems, launch supply-chain attacks, or cause persistent service disruption. Organizations relying on LXD's project restrictions for security isolation face complete loss of that isolation layer if any operator account is compromised or acts maliciously.

Affected systems

The vulnerability affects Canonical LXD in three supported release series: versions 6.0 through 6.8 (inclusive), versions 5.21.0 through 5.21.4 (inclusive), and versions 5.0.0 through 5.0.6 (inclusive). LXD 6.9, 5.21.5, and 5.0.7 or later contain the fix. Organizations should verify their installed LXD version and cross-reference against these ranges. The vulnerability requires an authenticated account with project operator privileges, so it does not affect standalone or single-tenant LXD deployments without multi-project configurations, though those deployments may still be at risk if project features are enabled for operational flexibility.

Exploitability

Exploitation requires an existing authenticated project operator account in a restricted multi-tenant environment—an insider threat or compromised credential scenario. No network authentication is needed if the attacker already has operator access, and no user interaction is required to restore a snapshot. The attack surface is limited to authenticated users, but the barrier to entry is low once that access exists. The CVSS vector (AV:N/AC:L/PR:H) reflects network accessibility and high-privilege requirement; the high impact score (C:H/I:H/A:H) reflects complete host compromise. While this is not an unauthenticated remote code execution vulnerability, it is a severe privilege escalation that completely undermines the security model of multi-tenant LXD deployments.

Remediation

Upgrade LXD to version 6.9 or later for the LXD 6.x series, version 5.21.5 or later for the 5.21.x series, or version 5.0.7 or later for the 5.0.x series. These versions include policy validation fixes that prevent restricted keys from being restored without proper authorization checks. Additionally, conduct an audit of project operator accounts and restrict operator privileges to only those who require them. Consider reviewing snapshot import and restore workflows to ensure they originate from trusted, internal sources only. Organizations with shared-tenant infrastructure should prioritize this patch immediately.

Patch guidance

Apply the latest patch version from Canonical's LXD security advisories for your release series. Patch testing should be performed in a staging environment that mimics your multi-tenant configuration before production deployment. Because this vulnerability affects the core tenant-isolation mechanism, patching should be treated as critical security maintenance. Plan patching as soon as feasible rather than deferring to a standard maintenance window. Canonical provides detailed upgrade instructions in their release notes; verify compatibility with your deployment topology and any custom scripts or integrations before applying.

Detection guidance

Monitor for suspicious snapshot import and restore operations, particularly when performed by project operators on instances that do not normally use snapshots. Log analysis should flag cases where a snapshot restoration precedes unusual instance configuration changes or host-level access patterns. Intrusion detection can watch for unexpected privilege escalation sequences following snapshot operations. Additionally, audit the project operator role memberships and verify they align with organizational access policies. If LXD audit logging is enabled, review logs for snapshot operations combined with subsequent host access attempts. Organizations can also validate the running configuration of critical instances against baseline snapshots to detect unauthorized changes.

Why prioritize this

This vulnerability merits immediate prioritization in multi-tenant LXD environments because it directly breaks the tenant-isolation model that these deployments rely on for security. A single compromised operator account can escalate to full host compromise, affecting all co-hosted tenants and the underlying infrastructure. The CVSS score of 7.2 (HIGH) reflects the severity of unauthorized root access, though the true business impact in shared environments is even more critical. The patch is available and relatively straightforward to deploy, making remediation both urgent and feasible.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects a high-severity vulnerability with network accessibility, low attack complexity, and high-privilege requirement, coupled with complete impact across confidentiality, integrity, and availability. In the context of multi-tenant LXD deployments, the actual risk is amplified because a single operator escalation undermines the entire tenant-isolation architecture, affecting multiple customers or business units simultaneously. Organizations not using LXD's multi-project/multi-tenant features face lower risk, but those relying on project restrictions for security should treat this as a critical vulnerability requiring emergency patching. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, but the low barrier to exploitation (requiring only authenticated access) and high impact (host root access) mean it could be weaponized quickly if disclosed publicly.

Frequently asked questions