CVE-2026-9640: Canonical Lxd

High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days.

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access.

Affected products

• Canonical Lxd: from 4.12, before 5.0.7 (fixed in 5.0.7); from 5.21.0, before 5.21.5 (fixed in 5.21.5); from 6.0, before 6.9 (fixed in 6.9)

Published 2026-06-26. Last modified 2026-07-02.