{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acanonicallxd/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.4,"id":"CVE-2026-12411"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LXD (\u003e= 0.0.0-20250721152936-fe86ceb2c3fa, \u003c 0.0.0-20260626085133-7cb96ac80a6d)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Canonical"],"content_html":"\u003cp\u003eLXD is susceptible to cross-guest volume hijacking due to missing ownership checks in the instance device-update path. When \u003ccode\u003esecurity.devlxd.management.volumes\u003c/code\u003e is enabled, the API fails to validate if an identity has ownership of a custom storage volume during a \u003ccode\u003ePATCH\u003c/code\u003e request to update instance devices. This enables a malicious guest to attach volumes belonging to other guests, resulting in full read/write access to the victim’s data. Volume names can be discovered via error probing.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a valid DevLXD identity with \u003ccode\u003ecan_edit\u003c/code\u003e permissions for their own instance.\u003c/li\u003e\n\u003cli\u003eAttacker probes for volume names by attempting to attach them via \u003ccode\u003ePATCH\u003c/code\u003e requests to the DevLXD instance endpoint.\u003c/li\u003e\n\u003cli\u003eLXD processes the \u003ccode\u003ePATCH\u003c/code\u003e request for a disk device.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edevLXDInstancePatchHandler\u003c/code\u003e validates the device configuration shape (type, pool, source) but skips volume ownership/RBAC checks.\u003c/li\u003e\n\u003cli\u003eLXD attaches the victim's volume to the attacker's instance.\u003c/li\u003e\n\u003cli\u003eAttacker reads or overwrites data within the mounted volume at the specified mount point.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation allows for unauthorized access, modification, and potential data exfiltration of storage volumes belonging to other tenants within the same LXD project. The impact is limited to environments where \u003ccode\u003esecurity.devlxd.management.volumes\u003c/code\u003e is explicitly enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade LXD to the version containing the fix for CVE-2026-12411 (\u0026gt;= 0.0.0-20260626085133-7cb96ac80a6d).\u003c/li\u003e\n\u003cli\u003eIn environments where patching is deferred, disable \u003ccode\u003esecurity.devlxd.management.volumes\u003c/code\u003e for all instances in shared projects.\u003c/li\u003e\n\u003cli\u003eAudit existing LXD instance configurations to identify unauthorized or unexpected disk devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T22:30:36Z","date_published":"2026-11-05T22:30:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-lxd-devlxd-hijack/","summary":"An authorization flaw in the LXD DevLXD storage API allows an authenticated guest container to attach and gain read/write access to arbitrary storage volumes owned by other guests within the same project.","title":"LXD: Cross-guest storage volume hijacking (CVE-2026-12411)","url":"https://feed.craftedsignal.io/briefs/2026-11-lxd-devlxd-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}